#IstioCon Istio Architecture Connect, secure, control, and observe services. #IstioCon Security Architecture #IstioCon Bookinfo architecture without service mesh ● Reviews-v1 ○ doesn’t call Request Cert (SDS)) 3. CSR Auth: JWT 4. Cert signed with SPIFFE format Istio-proxy CA server #IstioCon Istio identity – how to get configuration ● Format: "spiffe:///ns/server side mTLS mTLS in Istio - PeerAuthenticati on Using ingress port and ingress host to send request:

analysis Fraud & spam detection DDoS protection Application performance monitoring Logs & metrics Security events and logs. SIEM Analytics of corporate networks Telemetry Industrial monitoring Sensor data Better memory usage • No issues with GC and Java heap 2. Может запускаться встроенным в clickhouse-server • Нет необходимости в отдельном сервисе Разработчик: Alexander Sapin. Данные необходимо вставлять

app ➔ But everyone have the chance to download/sync all open data from this platform ➔ On the server side, it is a network, consisting of some/many nodes ➔ Every node has a blockchain node in it What run steady and persistent nodes for this platform? Two Major Problems ➔ End user drives, no security (or token fund) drives. ➔ Network is like a living creature, it will evolve – grow or die. The

};f # WARNING: Don't try this! Things We Have Done 1. Hardware Isolation 2. Security Tools - SELinux, Seccomp, AppArmor, Capabilities, Cgroup 3. Intrusion Detection - Monitor suspicious nginx EOT Rust- VMM Demo Future Works • Extend Rust-VMM to support networking and storage • Security policy integration • Develop a new fully Rust-based runtime for edge computing • Support live migration

Microkernel Overview I. Background  https://en.wikipedia.org/wiki/Microkernel Security I. Background  Difference Between Microkernel and Monolithic Kernel: Source: https://www with usermode VMMs Source: https://sel4.systems/About/seL4-whitepaper.pdf 1.2.1.3 Provable Security I. Background  .  https://docs.sel4.systems/projects/l4v/ https://github

need… • a Service Mesh, but to secure it I need… • an automated Certificate Authority, and for more security I need… • a Container scanning and monitoring service, and to monitor it more I need… • a Log Aggregation

O p s / 平 台 运 维 • I T / 基 础 设 施 • 测 试 / 安 全 团 队 持续测试 (Continuous Testing) 持续安全 (Continuous Security) 软件研发核心工程实践：交付工程 CI/CD 开发者实践 软件研发核心工程实践：全流程质量工程实践 - 持续测试 CT/ 持续安全 CS 协 同 特 点 ： • 流 程 可 定 义

modified request • 模拟数据规则 • 自动化测试 • https://github.com/wasmmock/ wasm_mock_server • 用 rust 打包所有测试需求 Wasm mock server Why use rust ？ Software testing tool • 模拟数据规则 • 自动化测试 • Company's own protocol platform • Support HTTP POST wasm API • Support websocket stand in for wasm API 抓包 - Wasm Mock Server wasm 工具 does not invent the wheel 软件测试工具 • 模拟数据规则 • 自动化测试 ModifyRequest(req *http.Request) error{ Response) error{ … res_,err:=wasm.Invoke(ctx,res.url.path, req_payload) … res = res_ } Wasm mock server 用了 Google martian 软件测试工具 • Websocket TCP mitm 例 子 extern crate wapc_guest as guest; use guest::prelude::*;

Files High Compression (column store + LZ4) • Typically 100x faster than MySQL on Single Server • Semi-Linear Scalability to 100s of nodes High Performance © 2018 Percona. 8 MySQL Wire User Account etc Has information about Connection Events Available in MySQL Enterprise, Percona Server, MariaDB © 2018 Percona. 18 Audit Log Record Example {"audit_record":{"name":"Query","record localhost []","host":"localhost","os_user":"","ip":"","db":"sbtest"}} © 2018 Percona. 19 Percona Server Configuration • Install Audit Plugin • INSTALL PLUGIN audit_log SONAME 'audit_log.so'; • Configure

CPU the bottleneck • 1 CPU handles 500,000 pps • Make LB the bottleneck • The target server and client server shall be powerful enough Performance measurement Test topology Test result Service type