The Challenge: BYOD, Email, and SAP in a Zero-Trust World

At ShitOps, we believe in the power of bring your own device (BYOD) to boost productivity and employee satisfaction. However, allowing personal devices to access corporate email via SMTP and IMAP, and to interact with our SAP ERP system, presented a perfect storm of security risks. Traditional perimeter-based security was insufficient. We needed a solution that could enforce zero-trust principles while providing seamless access. Our existing monolithic email gateway was a bottleneck, and SAP access was limited to corporate laptops. We set out to build a next-generation security architecture that would be the envy of the industry.

The Solution: Apollo Federation and Microservices Mesh

After months of research and development, we designed a federated microservices architecture centered around Apollo Federation. This approach allows us to expose a single GraphQL endpoint that federates multiple microservices, each responsible for a specific domain. Our stack includes:

  • Email Microservice: Handles SMTP and IMAP protocols, providing a GraphQL interface for sending and receiving emails.

  • SAP Microservice: Connects to SAP via RFC and exposes GraphQL queries and mutations for common SAP operations.

  • Auth Microservice: Manages user authentication and authorization, leveraging advanced hashing algorithms.

  • Intrusion Detection System (IDS): A containerized IDS that monitors all traffic for malicious activity.

All microservices are deployed as containers in a Kubernetes cluster, orchestrated by Istio service mesh. The Apollo Federation gateway acts as the single entry point for all client requests.

flowchart TD A[BYOD Device] --> B[Apollo Federation Gateway] B --> C[Email Microservice] B --> D[SAP Microservice] B --> E[Auth Microservice] C --> F[SMTP Proxy] C --> G[IMAP Proxy] E --> H[Hashing Service] F --> I[Containerized Email Server] G --> I D --> J[SAP Connector] H --> K[Intrusion Detection System] I --> K J --> K K --> L[Security Dashboard]

Deep Dive: Email Microservice with SMTP and IMAP

The Email Microservice is the heart of our BYOD communication. It exposes GraphQL mutations like sendEmail and queries like fetchInbox. Internally, it translates these operations into SMTP and IMAP commands. For SMTP, we use a custom proxy that enforces DKIM signing and SPF checks. For IMAP, we implemented a stateful proxy that maintains session state across container restarts using Redis. All email content is hashed with SHA-256 to ensure integrity, and attachments are scanned by the IDS before being stored. The microservice is containerized and can scale horizontally based on CPU usage.

SAP Microservice: Bridging the Gap

Accessing SAP from BYOD devices is notoriously challenging. Our SAP Microservice abstracts SAP's RFC interface into a GraphQL schema. It supports queries like getCustomerDetails and mutations like createSalesOrder. The service uses connection pooling and circuit breakers to handle SAP's occasional sluggishness. All SAP credentials are stored in HashiCorp Vault, and communication is encrypted with TLS. The microservice runs in a container with resource limits to prevent SAP from overwhelming the cluster.

Authentication and Hashing Strategy

Security is paramount. Our Auth Microservice uses bcrypt for password hashing with a cost factor of 12. For token-based authentication, we use JWT with RS256 signing. Additionally, we employ SHA-256 hashing for message integrity checks. All hashing operations are offloaded to a dedicated Hashing Service (containerized, of course) to reduce load on the auth service. The Hashing Service exposes a gRPC API for other microservices to request hashes. This separation of concerns ensures that hashing is never a bottleneck.

Intrusion Detection System: The Watchful Guardian

Our containerized IDS is based on Suricata and runs as a sidecar in each microservice pod. It performs deep packet inspection on all ingress and egress traffic, including SMTP, IMAP, and GraphQL over HTTP. The IDS rules are updated automatically via a CI/CD pipeline. Alerts are sent to a centralized Security Dashboard and trigger automated responses, such as blocking the offending IP or throttling the user. The IDS also monitors for anomalies in hashing request patterns, which could indicate a brute-force attack.

Federation and Apollo Gateway

Apollo Federation allows us to compose a single GraphQL schema from multiple microservices. Each microservice defines its own subgraph, and the gateway stitches them together. This federation approach enables independent development and deployment. The gateway also handles authentication and rate limiting. We use Apollo Studio for schema validation and performance monitoring. The gateway itself is deployed as a container and scales horizontally.

BYOD Onboarding and Security Policies

Employees can onboard their personal devices through a self-service portal. The portal guides them through installing a mobile device management (MDM) profile that enforces screen lock and encryption. Once enrolled, the device receives a client certificate for mTLS authentication. The certificate is tied to the user's identity and is validated by the Apollo Federation gateway. This ensures that only authorized devices can access the GraphQL endpoint.

Deployment and Scaling

All microservices are deployed as containers in a Kubernetes cluster. We use Helm charts for templating and Argo CD for GitOps. The cluster is monitored by Prometheus and Grafana. Autoscaling is configured based on custom metrics like GraphQL query latency and SMTP queue depth. The IDS runs as a DaemonSet to ensure every node is monitored. We conducted load tests that showed the system can handle 10,000 concurrent BYOD users, though we haven't actually tested that with real users yet.

Performance and Reliability

The federated architecture provides resilience. If the SAP microservice fails, the gateway can still serve email-related queries. The IDS alerts us to any degradation. We use circuit breakers and retries with exponential backoff. The hashing service uses a consistent hashing ring to distribute load. In our staging environment, we achieved 99.99% uptime, although we haven't measured production yet.

Future Enhancements

We plan to add a blockchain-based audit log for all SAP transactions. We are also exploring integrating a machine learning model into the IDS for anomaly detection. Additionally, we will implement a GraphQL subscription for real-time email notifications.

Conclusion

Our federated microservices architecture, powered by Apollo Federation, has transformed BYOD security at ShitOps. By combining containerization, advanced hashing, and an Intrusion Detection System, we have created a solution that is both secure and scalable. We are confident that this architecture will serve us well for years to come.