SearcharxivSearch

arXiv subjects

Dev Bali

Publications and source records attributed to Dev Bali.

2 recordsLinked to original sources

Delta Fair Sharing: Performance Isolation for Multi-Tenant Storage Systems

Modern storage systems, often deployed to support multiple tenants in the cloud, must provide performance isolation. Unfortunately, traditional approaches such as fair sharing do not provide performance isolation for storage systems, because their resources (e.g., write buffers and read caches) exhibit high preemption delays. These delays lead to unacceptable spikes in client tail latencies, as clients may be forced to wait arbitrarily long to receive their fair share of resources. We introduce Delta Fair Sharing, a family of algorithms for sharing resources with high preemption delays. These algorithms satisfy two key properties: $\delta$-fairness, which bounds a client's delay in receiving its fair share of resources to $\delta$ time units, and $\delta$-Pareto-efficiency, which allocates unused resources to clients with unmet demand. Together, these properties capture resource-acquisition delays end-to-end, bound well-behaved clients' tail-latency spikes to $\delta$ time units, and ensure high utilization. We implement such algorithms in FAIRDB, an extension of RocksDB. Our evaluation shows that FAIRDB isolates well-behaved clients from high-demand workloads better than state-of-the-art alternatives.

cs.DB

Extracting Database Access-Control Policies From Web Applications

To safeguard sensitive user data, web developers typically rely on implicit access-control policies, which they implement using access checks and query filters. This ad hoc approach is error-prone as these scattered checks and filters are easy to misplace or misspecify, and the lack of an explicit policy precludes external access-control enforcement. More critically, it is difficult for humans to discern what policy is embedded in application code (i.e., what data the application may access) -- an issue that worsens as development teams evolve. This paper tackles policy extraction: the task of extracting the access-control policy embedded in an application by summarizing its data queries. An extracted policy, once vetted for errors, can stand alone as a specification for the application's data access, and can be enforced to ensure compliance as code changes over time. We introduce Ote, a policy extractor for Ruby on Rails web applications. Ote uses concolic execution to explore execution paths through the application, generating traces of SQL queries and conditions that trigger them. It then merges and simplifies these traces into a final policy that aligns with the observed behaviors. We applied Ote to three real-world applications and compared extracted policies to handwritten ones, revealing several errors in the latter.

cs.SE