arXiv subjects

Yasuo Okabe

Publications and source records attributed to Yasuo Okabe.

10 recordsLinked to original sources

arXiv2026

Cache-Consistent Dynamic Load Balancing for Kubernetes Controllers

As Kubernetes clusters grow, the scalability of controllers can become a bottleneck for the performance of the system. Distributing the load dynamically across multiple controller instances, however, raises the following two problems, and a controller can therefore be run only as a single instance today. The first problem is the cost of reassignment. A controller retrieves objects on the basis of the Labels attached to them, so in a naive design in which the assigned instance is recorded in a Label on every object, the Labels must be rewritten in proportion to the total number of objects whenever instances are added or removed. The second problem is cache consistency. A controller consults only its own cache when it reads an object and never refers to the actual data, so the cache has to be updated explicitly at the time of a reassignment. Furthermore, a controller manages a cache independently for each kind of object, so cache updates have to be synchronized across the kinds of objects. We propose a method for scaling Kubernetes controllers horizontally that combines lightweight load balancing with cache synchronization. A two-level Hash maps objects to Virtual Nodes, records their identifiers in Labels, and assigns Virtual Nodes to instances by Consistent Hashing. Whenever instances are added or removed, it therefore suffices to update the Label value specified when objects are retrieved, and no Label on an object has to be rewritten. The cache is also locked until the reassignment has completed, which prevents any reference to a stale cache. The version identifier of the data store is used to synchronize the kinds of objects with one another. We implemented the proposed method on Kubernetes and evaluated it: the processing throughput rises with the number of instances, and the time required for reassignment remains within an acceptable range.

cs.DC↗

arXiv2026

Indoor Space Authentication by ISS-based Keypoint Extraction from 3D Point Clouds

We propose ISS-RegAuth, a lightweight indoor space authentication framework that authenticates a user by comparing LiDAR captures of personal rooms. Prior work processes every point in the cloud, where planar surfaces such as walls and floors dominate similarity calculations, causing latency and potential privacy exposure. In contrast, ISS-RegAuth retains only 1-2\% of Intrinsic Shape Signatures (ISS) keypoints, computes their Fast Point Feature Histograms, and performs RANSAC and ICP on this sparse set. On 100 ARKitScenes pairs, this approach reduces the equal-error rate from 0.02 to 0.00, cuts processing time by 20\%, and lowers transmitted data to 2.2\% of the original. These results show that keypoint-based sparse representation can make privacy-preserving, edge-deployable indoor space authentication practical. As an early step, this work opens a path toward device-independent authentication and account-recovery mechanisms that rely on users' physical environments.

cs.CR↗

arXiv2025

WAON: A Large-Scale Japanese Image-Text Dataset for Cultural Adaptation in Contrastive Vision-Language Models

Contrastive vision-language models have achieved remarkable progress through large-scale pretraining. Recent work has shown that removing English-only caption filters and pretraining on global data is effective for improving multicultural performance. We study whether such global pretraining is sufficient for culture-specific understanding, or whether further adaptation with natively sourced data can boost performance beyond what global pretraining alone achieves. To enable this investigation, we present WAON, the largest publicly available native Japanese image-text dataset constructed from native Japanese web content in Common Crawl, containing approximately 155 million examples. We also introduce WAON-Bench, a manually curated Japanese cultural benchmark spanning 374 classes. Through comparative fine-tuning experiments on multiple Japanese image-text datasets, we observe that models fine-tuned on WAON consistently achieve stronger performance on Japanese cultural benchmarks than those fine-tuned on English-to-Japanese translated data. We release our dataset and code.

cs.CV↗

arXiv2024

Mewz: Lightweight Execution Environment for WebAssembly with High Isolation and Portability using Unikernels

Cloud computing requires isolation and portability for workloads. Cloud vendors must isolate each user's resources from others to prevent them from attacking other users or the whole system. Users may want to move their applications to different environments, for instance other cloud, on-premise servers, or edge devices. Virtual machines (VMs) and containers are widely used to achieve these requirements. However, there are two problems with combined use of VMs and containers. First, container images depend on host operating systems and CPU architectures. Users need to manage different container images for each platform to run the same codes on different OSes and ISAs. Second, performance is degraded by the overheads of both VMs and containers. Previous researches have solved each of these problems separately, but no solution solves both problems simultaneously. Therefore, execution environments of applications on cloud are required to be more lightweight and portable while ensuring isolation is required. We propose a new system that combines WebAssembly (Wasm) and unikernels. Wasm is a portable binary format, so it can be run on any host operating systems and architectures. Unikernels are kernels statically linked with applications, which reduces the overhead of guest kernel. In this approach, users deploy applications as a Wasm binary and it runs as a unikernel on cloud. To realize this system, we propose a mechanism to convert a Wasm binary into a unikernel image with the Wasm AoT-compiled to native code. We developed a unikernel with Wasm System Interface (WASI) API and an Ahead-of-Time (AoT) compiler that converts Wasm to native code. We evaluated the performance of the system by running a simple HTTP server compiled into Wasm and native code. The performance was improved by 30\% compared to running it with an existing Wasm runtime on Linux on a virtual machine.

cs.DC↗

arXiv2024

Distributed Tracing for Cascading Changes of Objects in the Kubernetes Control Plane

Kubernetes is a container orchestration system that employs a declarative configuration management approach. In Kubernetes, each desired and actual state is represented by an ``object'', and multiple controllers autonomously monitor related objects and update their objects towards the desired state in the control plane. Because of this design, changes to one object propagate to other objects in a chain. The cluster operators need to know the time required for these cascading changes to complete, as it directly affects the quality of service of applications running on the cluster. However, there is no practical way to observe this kind of cascading change, including breakdown of the time taken by each change. Distributed tracing techniques are commonly used in the microservices architecture to monitor application performance, but they are not directly applicable to the control plane of Kubernetes; the microservices architecture relies on explicitly calling APIs on other services, but in Kubernetes the controllers just monitor objects to know when to start processing, and never call functions on other controllers directly. In this paper, we propose a system that automatically traces changes to objects in the control plane. Our method adds one identifier, a Change Propagation ID (CPID), to the metadata of an object, and the controller that observes an object change propagates its CPID to the objects that the controller is updated. When multiple changes need to be merged on an object, a new CPID is generated, and the relationship between the original CPID and the new CPID is sent to the external trace server. We confirmed that change propagation can be visualized and the required time measured. We also showed that this system's overhead is not significant.

eess.SY↗

arXiv2023

Monitoring Cascading Changes of Resources in the Kubernetes Control Plane

Kubernetes is a container management system that has many automated functionalities. Those functionalities are managed by configuring objects and resources in the control plane. Since most objects change their state depending on other objects' states, a change propagates to other objects in a chain. As cluster availability is influenced by the time required for these cascading changes, it is essential to make the propagations measurable and shed light on the behavior of the Kubernetes control plane. However, it is not easy because each object constantly monitors other objects' status and acts autonomously in response to their changes to play its role. In this paper, we propose a measurement system that outputs objects' change logs published from the API server in the control plane and assists in analyzing the time of cascading changes between objects by utilizing the relationships among resources. With a practical change scenario, our system is confirmed that it can measure change propagation times within a cascading change. Also, measurements on the system itself showed it has a small CPU and memory footprint.

cs.DC↗

arXiv2022

Zero Trust Federation: Sharing Context under User Control toward Zero Trust in Identity Federation

To securely control access to systems, the concept of Zero Trust has been proposed. Access Control based on Zero Trust concept removes implicit trust and instead focuses on evaluating trustworthiness at every access request by using contexts. Contexts are information about the entity making an access request like the user and the device status. Consider the scenario of Zero Trust in an identity federation where the entity (Relying Party; RP) enforces access control based on Zero Trust concept. RPs should continuously evaluate trustworthiness by using collected contexts by themselves, but RPs where users rarely access cannot collect enough contexts on their own. Therefore, we propose a new federation called Zero Trust Federation (ZTF). In ZTF, contexts as well as identity are shared so that RPs can enforce access control based on Zero Trust concept. Federated contexts are managed by a new entity called Context Attribute Provider, which is independent of Identity Providers. We design a mechanism sharing contexts among entities in a ZTF by using the two protocols; context transport protocol based on Continuous Access Evaluation Protocol and user consent protocol based on User Managed Access. We implemented the ZTF prototype and evaluated the capability of ZTF in 4 use-cases.

cs.CR↗

arXiv2022

Linking Contexts from Distinct Data Sources in Zero Trust Federation

An access control model called Zero Trust Architecture (ZTA) has attracted attention. ZTA uses information of users and devices, called context, for authentication and authorization. Zero Trust Federation (ZTF) has been proposed as a framework for extending an idea of identity federation to support ZTA. ZTF defines CAP as the entity that collects context and provides it to each organization (Relying Party; RP) that needs context for authorization based on ZTA. To improve the quality of authorization, CAPs need to collect context from various data sources. However, ZTF did not provide a method for collecting context from data sources other than RP. In this research, as a general model for collecting context in ZTF, we propose a method of linking identifiers between the data source and CAP. This method provides a way to collect context from some of such data sources in ZTF. Then, we implemented our method using RADIUS and MDM as data sources and confirmed that their contexts could be collected and used.

cs.CR↗

arXiv2022

Key Management Based on Ownership of Multiple Authenticators in Public Key Authentication

Public key authentication (PKA) has been deployed in various services to provide stronger authentication to users. In PKA, a user manages private keys on her devices called authenticators, and services bind the corresponding public keys to her account. To protect private keys, a user uses authenticators which never export private keys outside. On the other hand, a user regularly uses multiple authenticators like PCs and smartphones. She replaces some of her authenticators according to their lifecycle, such as purchasing new devices and losing devices. It is a burden for a user to register, update and revoke public keys in many services every time she registers new accounts with services and replaces some of her authenticators. To ease the burden, we propose a mechanism where users and services manage public keys based on the owner of authenticators and users can access services with PKA using any of their authenticators. We introduce a key pair called an Ownership Verification Key (OVK), which consists of the private key (OVSK) and the corresponding public key (OVPK). All authenticators owned by a user derive the same OVSK from the pre-shared secret called the seed. Services verify the ownership of the authenticators using the corresponding OVPK to determine whether binding the requested public key to her account. To protect user privacy while maintaining convenience, authenticators generate a different OVK for each service from the seed independently. We demonstrate the feasibility through the Proof of Concept implementation, show that our proposed mechanism achieves some security goals, and discuss how the mechanism mitigates threats not completely handled.

cs.CR↗

arXiv2021

Acila: Attaching Identities of Workloads for Efficient Packet Classification in a Cloud Data Center Network

IP addresses and port numbers (network based identifiers hereafter) in packets are two major identifiers for network devices to identify systems and roles of hosts sending and receiving packets for access control lists, priority control, etc. However, in modern system design on cloud, such as microservices architecture, network based identifiers are inefficient for network devices to identify systems and roles of hosts. This is because, due to autoscaling and automatic deployment of new software, many VMs and containers consisting of the system (workload hereafter) are frequently created and deleted on servers whose resources are available, and network based identifiers are assigned based on servers where containers and VMs are running. In this paper, we propose a new system, Acila, to classify packets based on the identity of a workload at network devices, by marking packets with the necessary information extracted from the identity that usually stored in orchestrators or controllers. We then implement Acila and show that packet filtering and priority control can be implemented with Acila, and entries for them with Acila is more efficient than conventional network based identifiers approach, with little overhead on performance

cs.NI↗