EMICRO: Real-Time Multi-Hop Access Control for Microservices with eBPF

Modern cloud applications often comprise thousands of microservices whose interactions form complex request paths. Traditional inter-service access control restricts individual service-to-service requests, but fails to prevent multi-hop at- tacks, where each hop appears legitimate yet the overall path violates security intent. This gap leaves systems exposed to unauthorized access and data exfiltration. In this paper, we present EMICRO, a path-aware defense system for microser- vices that prevents such attacks while remaining efficient and deployable. EMICRO enforces real-time multi-hop access con- trol through three key techniques: (1) history-based access control extended to capture service invocation sequences; (2) security policies encoded as efficient deterministic fi- nite automaton (DFA), supporting constant-time lookups and compact label propagation; (3) eBPF-based in-kernel request tracing for transparent, low-overhead enforcement without code changes. Evaluations on DeathStarBench and production cloud traces from Uber, Alibaba, and ByteDance, covering 12 million request workflows and thousands of services, demon- strate the scalability of EMICRO. EMICRO performs policy checks in 1 μs, stores 50 million policies in only 100 MB, and reduces propagation overhead by 90% with negligible runtime impact. These results show that EMICRO delivers scalable and efficient protection against multi-hop attacks, making it practical for deployment in large-scale microser- vice environments.