AccessRefinery: Fast Mining Concise Access Control Intents on Public Cloud
Modern cloud applications heavily rely on Identity and Access Management (IAM) services to enforce flexible access control over their data. However, the flexibility comes at a cost: IAM policies are often complex and prone to misconfigurations, leading to risks of data exposure. There is an increasing need to mine a compact set of intents that describe what the policies collectively try to achieve, thereby enabling operators to better understand their policies. However, existing tools on mining access control intent have two major limitations: (1) the mining process is slow and even times out on some complex policies; (2) the mined intents are excessive in number and thus still hard to understand. To overcome these limitations, this paper presents AccessRefinery, which can speed up the mining process while reducing the number of intents. The key idea for the speedup is to reduce the redundancy of the multi-round SMT solving, by preprocessing the constraints into bit-vector constraints. For intent reduction, AccessRefinery computes a compact set of intents that can cover the mined intents, by solving a min-set-cover problem. Experiments based on real and synthetic datasets show that AccessRefinery achieves a ~10–100× speedup in intent mining, and reduces the number of intents by up to ~10×.
Wed 8 JulDisplayed time zone: Eastern Time (US & Canada) change
10:30 - 12:30 | CloudIndustry Papers / Research Papers / Journal-First Paper at MB 2.435 Chair(s): Mariam El Mezouar Royal Military College | ||
10:30 20mTalk | Aloha: Localizing Batch Failures in Large-scale Cloud Systems via Contrast Analysis and Human-in-the-Loop Agent Industry Papers Shenglin Zhang Nankai University, Yujia Wu Nankai University, Jinghuan Ren Nankai University, College of Software, Yongqian Sun Nankai University, Wenwei Gu Nankai University, Chaoyun Zhang Microsoft, Liqun Li Microsoft Research, Qingwei Lin Microsoft, Dongmei Zhang Microsoft, Saravanakumar Rajmohan Microsoft 365, Chetan Bansal Microsoft Research, Minghua Ma Microsoft | ||
10:50 20mTalk | Attention Enhanced Entity Recommendation for Intelligent Monitoring in Cloud Systems Industry Papers Fiza Husain Independent, Anson Bastos Microsoft, Anjaly Parayil Microsoft, Ayush Choure Independent, Chetan Bansal Microsoft Research, Rujia Wang Microsoft, Saravanakumar Rajmohan Microsoft 365 | ||
11:10 20mTalk | An Agentic Framework for Triaging Incidents in Production Cloud Infrastructure Industry Papers Yuhan Yao Microsoft, Yuxuan Jiang University of Michigan Ann-Arbor, Minghua Ma Microsoft, Madhura Vaidya Microsoft, Jieren Deng Microsoft, Yigong Hu Boston University, Chetan Bansal Microsoft Research, Ze Li Microsoft Azure, Murali Chintalapati Microsoft Azure | ||
11:30 20mTalk | TSGuard: Automated User-Centric Incident Diagnosis for AI Workloads in the Cloud Research Papers Yitao Yang The Chinese University of Hong Kong, Yangtao Deng The Chinese University of Hong Kong, Yifan Xiong Microsoft Research, Baochun Li University of Toronto, Hong Xu The Chinese University of Hong Kong, Peng Cheng Microsoft Research Asia Pre-print | ||
11:50 20mTalk | Exploring the impact of cloud computing on software architecture for sustainability: A practitioners' perspective Journal-First Paper | ||
12:10 20mTalk | AccessRefinery: Fast Mining Concise Access Control Intents on Public Cloud Research Papers Ning Kang Xi'an Jiaotong University, Peng Zhang Xi'an Jiaotong University, Jianyuan Zhang Xi'an Jiaotong University, Hao Li Xi'an Jiaotong University, Dan Wang Xi'an Jiaotong University, Zhenrong Gu Xi'an Jiaotong University, Weibo Lin Huawei Cloud, Shibiao Jiang Huawei Cloud, Zhu He Huawei Cloud, Xu Du Huawei Cloud, Longfei Chen Huawei Cloud, Jun Li Huawei, Xiaohong Guan Xi'an Jiaotong University DOI Pre-print | ||