eMicro: Real-Time Multi-Hop Access Control for Microservices with eBPF

2026-08-05

AI Summary

This work addresses the vulnerability of traditional microservice access control to multi-hop attacks, where individually legitimate calls can be combined into policy-violating paths that lead to unauthorized access. To counter this, the authors propose a path-aware, real-time access control mechanism that, for the first time, encodes security policies using deterministic finite automata (DFA), enabling constant-time policy matching and compact label propagation. By integrating eBPF-based, kernel-level, non-intrusive tracing with historical call sequence analysis, the system provides transparent protection against multi-hop attacks without requiring any application code modifications. Experimental results demonstrate that the approach incurs only 1 microsecond per policy check under tens of millions of requests, consumes just 100 MB of memory for 50 million policies, reduces label propagation overhead by 90%, and imposes negligible runtime performance impact.

Abstract

Modern cloud applications often comprise thousands of microservices whose interactions form complex request paths. Traditional inter-service access control restricts individual service-to-service requests, but fails to prevent multi-hop attacks, where each hop appears legitimate yet the overall path violates security intent. This gap leaves systems exposed to unauthorized access and data exfiltration. In this paper, we present eMicro, a path-aware defense system for microservices that prevents such attacks while remaining efficient and deployable. eMicro enforces real-time multi-hop access control through three key techniques: (1) history-based access control extended to capture service invocation sequences; (2) security policies encoded as efficient deterministic finite automaton (DFA), supporting constant-time lookups and compact label propagation; (3) eBPF-based in-kernel request tracing for transparent, low-overhead enforcement without code changes. Evaluations on DeathStarBench and production cloud traces from Uber, Alibaba, and ByteDance, covering 12 million request workflows and thousands of services, demonstrate the scalability of eMicro. eMicro performs policy checks in 1 microsecond, stores 50 million policies in only 100 MB, and reduces propagation overhead by 90% with negligible runtime impact. These results show that eMicro delivers scalable and efficient protection against multi-hop attacks, making it practical for deployment in large-scale microservice environments.

Problem

• microservices
• multi-hop attacks
• access control
• security policy
• request path

Innovation

• multi-hop access control
• eBPF
• deterministic finite automaton
• microservices security
• path-aware enforcement