{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:11:33Z","timestamp":1760033493987,"version":"build-2065373602"},"reference-count":38,"publisher":"Association for Computing Machinery (ACM)","issue":"OOPSLA2","license":[{"start":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T00:00:00Z","timestamp":1759968000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2312714, 2152831"],"award-info":[{"award-number":["2312714, 2152831"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Program. Lang."],"published-print":{"date-parts":[[2025,10,9]]},"abstract":"<jats:p>A microservice-based application is composed of multiple self-contained components called microservices, and controlling inter-service communication is important for enforcing safety properties. Presently, inter-service communication is configured using microservice deployment tools. However, such tools only support a limited class of single-hop policies, which can be overly permissive because they ignore the rich service tree structure of microservice calls. Policies that can express the service tree structure can offer development and security teams more fine-grained control over communication patterns.<\/jats:p>\n          <jats:p>To this end, we design an expressive policy language to specify service tree structures, and we develop a visibly pushdown automata-based dynamic enforcement mechanism to enforce service tree policies. Our technique is non-invasive: it does not require any changes to service implementations, and does not require access to microservice code. To realize our method, we build a runtime monitor on top of a service mesh, an emerging network infrastructure layer that can control inter-service communication during deployment. In particular, we employ the programmable network traffic filtering capabilities of Istio, a popular service mesh implementation, to implement an online and distributed monitor. Our experiments show that our monitor can enforce rich safety properties while adding minimal latency overhead on the order of milliseconds.<\/jats:p>","DOI":"10.1145\/3763127","type":"journal-article","created":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T08:49:50Z","timestamp":1759999790000},"page":"2144-2170","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SafeTree: Expressive Tree Policies for Microservices"],"prefix":"10.1145","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-1280-6892","authenticated-orcid":false,"given":"Karuna","family":"Grewal","sequence":"first","affiliation":[{"name":"Cornell University, Ithaca, USA"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-2930-1982","authenticated-orcid":false,"given":"Brighten","family":"Godfrey","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign, Urbana-Champaign, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8953-7060","authenticated-orcid":false,"given":"Justin","family":"Hsu","sequence":"additional","affiliation":[{"name":"Cornell University, Ithaca, USA"}]}],"member":"320","published-online":{"date-parts":[[2025,10,9]]},"reference":[{"key":"e_1_2_2_1_1","unstructured":"Proton AG. 2024. Complete guide to GDPR compliance. https:\/\/gdpr.eu\/ Accessed: 2024-11-04"},{"key":"e_1_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3276488"},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24730-2_35"},{"key":"e_1_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1007352.1007390"},{"key":"e_1_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1007\/11779148_1"},{"key":"e_1_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355609"},{"key":"e_1_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10817-017-9410-z"},{"key":"e_1_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485510"},{"key":"e_1_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.5555\/1770532.1770559"},{"volume-title":"Runtime Verification (RV)","author":"Decker Normann","key":"e_1_2_2_10_1","unstructured":"Normann Decker, Martin Leucker, and Daniel Thoma. 2013. Impartiality and Anticipation for Monitoring of Visibly Context-Free Properties. In Runtime Verification (RV), Rennes, France. Springer-Verlag, 183\u2013200. isbn:978-3-642-40787-1"},{"key":"e_1_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0022-0000(70)80041-1"},{"key":"e_1_2_2_12_1","volume-title":"Tree Automata and Tree Grammars. CoRR, abs\/1510.02036","author":"Engelfriet Joost","year":"2015","unstructured":"Joost Engelfriet. 2015. Tree Automata and Tree Grammars. CoRR, abs\/1510.02036 (2015), arXiv:1510.02036. arxiv:1510.02036"},{"key":"e_1_2_2_13_1","unstructured":"Envoy. 2024. Envoy Proxy. https:\/\/www.envoyproxy.io\/ Accessed: 2024-11-04"},{"key":"e_1_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304013"},{"key":"e_1_2_2_15_1","unstructured":"Karuna Grewal. 2025. SafeTree Compiler. https:\/\/github.com\/aakp10\/SafeTree-Compiler"},{"key":"e_1_2_2_16_1","doi-asserted-by":"publisher","unstructured":"Karuna Grewal. 2025. SafeTree: Expressive Tree Policies for Microservcies. https:\/\/doi.org\/10.5281\/zenodo.15751182 10.5281\/zenodo.15751182","DOI":"10.5281\/zenodo.15751182"},{"key":"e_1_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3626111.3628181"},{"key":"e_1_2_2_18_1","unstructured":"Karuna Grewal P. Brighten Godfrey and Justin Hsu. 2025. SafeTree: Expressive Tree Policies for Microservices. arxiv:2508.16746. arxiv:2508.16746"},{"key":"e_1_2_2_19_1","unstructured":"Istio. 2024. Istio. https:\/\/istio.io\/ Accessed: 2024-11-04"},{"key":"e_1_2_2_20_1","unstructured":"Jaeger. 2024. Jaeger. https:\/\/www.jaegertracing.io\/ Accessed: 2024-11-04"},{"key":"e_1_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3360575"},{"key":"e_1_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3571206"},{"volume-title":"USENIX Security Smposium (USENIX)","author":"Kang Qiao","key":"e_1_2_2_23_1","unstructured":"Qiao Kang, Lei Xue, Adam Morrison, Yuxin Tang, Ang Chen, and Xiapu Luo. 2020. Programmable In-Network Security for Context-aware BYOD Policies. In USENIX Security Smposium (USENIX). USENIX Association, 595\u2013612. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/kang"},{"key":"e_1_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3482898.3483352"},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3472883.3487003"},{"key":"e_1_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2008.25"},{"key":"e_1_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPS.2015.95"},{"key":"e_1_2_2_28_1","unstructured":"US Department of Health and Human Services. 2024. Summary of the HIPAA Privacy Rule. https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/laws-regulations\/index.html Accessed: 2024-11-04"},{"key":"e_1_2_2_29_1","unstructured":"US Department of Health and Human Services. 2024. The De-identification Standard. https:\/\/www.hhs.gov\/hipaa\/for-professionals\/special-topics\/de-identification\/index.html"},{"key":"e_1_2_2_30_1","unstructured":"OpenTelemetry. 2024. OpenTelemetry. https:\/\/opentelemetry.io\/ Accessed: 2024-11-04"},{"key":"e_1_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1147\/rd.32.0114"},{"key":"e_1_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3603269.3604856"},{"key":"e_1_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89247-2_4"},{"key":"e_1_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2002.806121"},{"key":"e_1_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3669940.3707257"},{"key":"e_1_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3110280"},{"key":"e_1_2_2_37_1","volume-title":"Aragog: Scalable Runtime Verification of Shardable Networked Systems. In USENIX Symposium on Operating Systems Design and Implementation (OSDI), Virtual Event. USENIX Association, 701\u2013718","author":"Yaseen Nofel","year":"2020","unstructured":"Nofel Yaseen, Behnaz Arzani, Ryan Beckett, Selim Ciraci, and Vincent Liu. 2020. Aragog: Scalable Runtime Verification of Shardable Networked Systems. In USENIX Symposium on Operating Systems Design and Implementation (OSDI), Virtual Event. USENIX Association, 701\u2013718. https:\/\/www.usenix.org\/conference\/osdi20\/presentation\/yaseen"},{"key":"e_1_2_2_38_1","unstructured":"Zipkin. 2024. Zipkin. https:\/\/zipkin.io\/ Accessed: 2024-11-04"}],"container-title":["Proceedings of the ACM on Programming Languages"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3763127","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3763127","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T17:49:18Z","timestamp":1760032158000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3763127"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,9]]},"references-count":38,"journal-issue":{"issue":"OOPSLA2","published-print":{"date-parts":[[2025,10,9]]}},"alternative-id":["10.1145\/3763127"],"URL":"https:\/\/doi.org\/10.1145\/3763127","relation":{},"ISSN":["2475-1421"],"issn-type":[{"type":"electronic","value":"2475-1421"}],"subject":[],"published":{"date-parts":[[2025,10,9]]},"assertion":[{"value":"2025-03-26","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-08-12","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}