SafeTree: Expressive Tree Policies for Microservices
summary
Defines a policy language that compiles to a visibly pushdown automata and proves the compilation is sound for nested-word views of service-call trees, implements a distributed runtime monitor on a service mesh using Istio without changing service code, encodes VPA configurations in HTTP headers taking only 6 bits header, and measures worst-case added latency around 2 ms on benchmark microservice cases with thousands of VPA states. Artifacts and reproducible results accompany the paper.
AI-written summary · about
chapters (9)
- 0:00SafeTree introduction
- 1:48Microservice policy challenges
- 4:35Nested words for service trees
- 6:18Designing tree policies
- 8:26Compiling to pushdown automata
- 9:54Distributed runtime monitoring
- 12:21Evaluation results and overhead
- 13:04Summary and future work
- 13:47Q&A on nested words
related talks
22mDynamic Policy Enforcement for Privacy Techniques in Microservice Architectures
36mDynamic and Context-Aware Security Policies for the Cloud Using...
14mFormal specifications for Microservices -
42mA blueprint for building a generic... (Ashwin Sidhalinganahalli, Fletcher Ramee)
23mMicroservice Security at the API Level
22mThe Cloud Native Paradigm: 2019 and Beyond
40mMeasuring Micro-services
30mCan security speed development? Network policies, but with people in mind