Performance and Security Tradeoffs in Microservices Communication: Evaluating Reactive and Virtual-Thread Architectures Under Security-Enabled Systems

Abstract

Ensuring robust security without compromising performance remains a persistent challenge in microservices architectures. Reactive, non-blocking frameworks are often recommended for high-concurrency workloads, yet the introduction of virtual threads in the Java platform (Project Loom) raises a question of whether reactive programming retains a performance advantage when a blocking REST-based implementation can offload thread management to the JVM. This paper presents and empirically evaluates a reactive microservices architecture integrating multi-layered security mechanisms, including Mutual Transport Layer Security (mTLS), JWT based token binding, Role-Based Access Control (RBAC), and Claim-Based Access Control (CBAC), and compares it against a functionally equivalent REST-based counterpart using virtual threads, Apache Tomcat, and REST/JSON interservice communication under identical security configurations. The system employs RSocket for inter-service communication and Protocol Buffers for low-overhead binary serialization. Load tests with 100, 300, and 500 concurrent users show that virtual threads substantially reduce the end-to-end latency and throughput differences between the two architectures. The reactive implementation consistently achieves lower CPU utilization at the API Gateway, up to six times lower at 300 concurrent users, demonstrating that non-blocking execution remains more resource-efficient even when virtual threads mitigate explicit thread blocking. Both architectures sustain zero failed requests across all load levels. These results indicate that the choice between reactive and virtual-thread-based REST involves a trade-off between resource efficiency and implementation complexity while maintaining high-security guarantees.