{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T13:33:34Z","timestamp":1790948014552,"version":"4.1.0"},"reference-count":38,"publisher":"Association for Computing Machinery (ACM)","issue":"OOPSLA2","license":[{"start":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T00:00:00Z","timestamp":1759968000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2312714, 2152831"],"award-info":[{"award-number":["2312714, 2152831"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Program. Lang."],"published-print":{"date-parts":[[2025,10,9]]},"abstract":"<jats:p>\n                    A microservice-based application is composed of multiple self-contained components called\n                    <jats:italic toggle=\"yes\">microservices<\/jats:italic>\n                    , and controlling inter-service communication is important for enforcing safety properties. Presently, inter-service communication is configured using microservice deployment tools. However, such tools only support a limited class of\n                    <jats:italic toggle=\"yes\">single-hop<\/jats:italic>\n                    policies, which can be overly permissive because they ignore the rich\n                    <jats:italic toggle=\"yes\">service tree<\/jats:italic>\n                    structure of microservice calls. Policies that can express the service tree structure can offer development and security teams more fine-grained control over communication patterns.\n                  <\/jats:p>\n                  <jats:p>\n                    To this end, we design an expressive policy language to specify service tree structures, and we develop a\n                    <jats:italic toggle=\"yes\">visibly pushdown automata<\/jats:italic>\n                    -based dynamic enforcement mechanism to enforce\n                    <jats:italic toggle=\"yes\">service tree<\/jats:italic>\n                    policies. Our technique is non-invasive: it does not require any changes to service implementations, and does not require access to microservice code. To realize our method, we build a runtime monitor on top of a\n                    <jats:italic toggle=\"yes\">service mesh<\/jats:italic>\n                    , an emerging network infrastructure layer that can control inter-service communication during deployment. In particular, we employ the programmable network traffic filtering capabilities of Istio, a popular service mesh implementation, to implement an online and distributed monitor. Our experiments show that our monitor can enforce rich safety properties while adding minimal latency overhead on the order of milliseconds.\n                  <\/jats:p>","DOI":"10.1145\/3763127","type":"journal-article","created":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T08:49:50Z","timestamp":1759999790000},"page":"2144-2170","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["SafeTree: Expressive Tree Policies for Microservices"],"prefix":"10.1145","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-1280-6892","authenticated-orcid":false,"given":"Karuna","family":"Grewal","sequence":"first","affiliation":[{"name":"Cornell University, Ithaca, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-2930-1982","authenticated-orcid":false,"given":"Brighten","family":"Godfrey","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign, Urbana-Champaign, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8953-7060","authenticated-orcid":false,"given":"Justin","family":"Hsu","sequence":"additional","affiliation":[{"name":"Cornell University, Ithaca, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,10,9]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"Proton AG. 2024. Complete guide to GDPR compliance. https:\/\/gdpr.eu\/. Accessed: 2024-11-04."},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3276488"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24730-2_35"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/1007352.1007390"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1007\/11779148_1"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3355609"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10817-017-9410-z"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485510"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.5555\/1770532.1770559"},{"key":"e_1_3_2_11_2","doi-asserted-by":"crossref","unstructured":"NormannDecker MartinLeucker DanielThoma. 2013. Impartiality and Anticipation for Monitoring of Visibly Context-Free Properties. In Runtime Verification (RV) Rennes France. Springer-Verlag 183\u2013200.","DOI":"10.1007\/978-3-642-40787-1_11"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/S0022-0000(70)80041-1"},{"key":"e_1_3_2_13_2","unstructured":"JoostEngelfriet. 2015. Tree Automata and Tree Grammars. CoRR abs\/1510.02036.1510.02036 http:\/\/arxiv.org\/abs\/1510.02036."},{"key":"e_1_3_2_14_2","unstructured":"Envoy. 2024. Envoy Proxy. https:\/\/www.envoyproxy.io\/. Accessed: 2024-11-04."},{"key":"e_1_3_2_15_2","volume-title":"Proceedings of the ACM on Programming Languages","author":"Gan Yu","year":"2025","unstructured":"YuGan et al.. 2025. An Open-Source Benchmark Suite for Microservices and Their Hardware-Software Implications for Cloud & Edge Systems. Proceedings of the ACM on Programming Languages 9, OOPSLA2, Article 349."},{"key":"e_1_3_2_16_2","unstructured":"KarunaGrewal. 2025. SafeTree Compiler. https:\/\/github.com\/aakp10\/SafeTree-Compiler."},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","unstructured":"KarunaGrewal. 2025. SafeTree: Expressive Tree Policies for Microservices. doi:10.5281\/zenodo.15751182","DOI":"10.5281\/zenodo.15751182"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","unstructured":"KarunaGrewal Philip BrightenGodfrey JustinHsu. 2023. Expressive Policies For Microservice Networks. In USENIX HotCloud 280\u2013286. doi:10.1145\/3626111.3628181","DOI":"10.1145\/3626111.3628181"},{"key":"e_1_3_2_19_2","unstructured":"KarunaGrewal et al.. 2025. SafeTree: Expressive Tree Policies for Microservices. arXiv 2508.16746 https:\/\/arxiv.org\/abs\/2508.16746."},{"key":"e_1_3_2_20_2","unstructured":"Istio. 2024. Istio. https:\/\/istio.io\/. Accessed: 2024-11-04."},{"key":"e_1_3_2_21_2","unstructured":"Jaeger. 2024. Jaeger. https:\/\/www.jaegertracing.io\/. Accessed: 2024-11-04."},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3360575"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3571206"},{"key":"e_1_3_2_24_2","unstructured":"QiaoKang et al.. 2020. Programmable In-Network Security for Context-aware BYOD Policies. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/kang."},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","unstructured":"K. ShivKumar et al.. 2021. DBVal: Validating P4 Data Plane Runtime Behavior. In ACM SOSR 122\u2013134. doi:10.1145\/3482898.3483352","DOI":"10.1145\/3482898.3483352"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","unstructured":"ShutianLuo et al.. 2021. Characterizing Microservice Dependency and Performance: Alibaba Trace Analysis. In ACM SoCC 412\u2013426. doi:10.1145\/3472883.3487003","DOI":"10.1145\/3472883.3487003"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","unstructured":"P. O.Meredith et al.. 2008. Efficient Monitoring of Parametric Context-Free Patterns. In IEEE\/ACM ASE 148\u2013157. doi:10.1109\/ASE.2008.25","DOI":"10.1109\/ASE.2008.25"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","unstructured":"MennaMostafa BorzooBonakdarpour. 2015. Decentralized Runtime Verification of LTL Specifications in Distributed Systems. In IEEE IPDPS 494\u2013503. doi:10.1109\/IPDPS.2015.95","DOI":"10.1109\/IPDPS.2015.95"},{"key":"e_1_3_2_29_2","unstructured":"US Department of Health and Human Services. 2024. Summary of the HIPAA Privacy Rule. https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/laws-regulations\/index.html. Accessed: 2024-11-04."},{"key":"e_1_3_2_30_2","unstructured":"US Department of Health and Human Services. 2024. The De-identification Standard. https:\/\/www.hhs.gov\/hipaa\/for-professionals\/special-topics\/de-identification\/index.html."},{"key":"e_1_3_2_31_2","unstructured":"OpenTelemetry. 2024. OpenTelemetry. https:\/\/opentelemetry.io\/. Accessed: 2024-11-04."},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1147\/rd.32.0114"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","unstructured":"SundararajanRenganathan et al.. 2023. Hydra: Effective Runtime Network Verification. In ACM SIGCOMM 182\u2013194. doi:10.1145\/3603269.3604856","DOI":"10.1145\/3603269.3604856"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","unstructured":"GrigoreRosu et al.. 2008. Synthesizing Monitors for Safety Properties: This Time with Calls and Returns. In Runtime Verification (RV). doi:10.1007\/978-3-540-89247-2_4","DOI":"10.1007\/978-3-540-89247-2_4"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2002.806121"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","unstructured":"DivyanshuSaxena et al.. 2025. Copper and Wire: Bridging Expressiveness and Performance for Service Mesh Policies. In ASPLOS 233\u2013248. doi:10.1145\/3669940.3707257","DOI":"10.1145\/3669940.3707257"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3110280"},{"key":"e_1_3_2_38_2","unstructured":"NofelYaseen et al.. 2020. Aragog: Scalable Runtime Verification of Shardable Networked Systems. In USENIX OSDI 701\u2013718. https:\/\/www.usenix.org\/conference\/osdi20\/presentation\/yaseen."},{"key":"e_1_3_2_39_2","unstructured":"Zipkin. 2024. Zipkin. https:\/\/zipkin.io\/. Accessed: 2024-11-04."}],"container-title":["Proceedings of the ACM on Programming Languages"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3763127","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3763127","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T10:09:39Z","timestamp":1784196579000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3763127"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,9]]},"references-count":38,"journal-issue":{"issue":"OOPSLA2","published-print":{"date-parts":[[2025,10,9]]}},"alternative-id":["10.1145\/3763127"],"URL":"https:\/\/doi.org\/10.1145\/3763127","relation":{},"ISSN":["2475-1421"],"issn-type":[{"value":"2475-1421","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,9]]},"assertion":[{"value":"2025-03-26","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-08-12","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}