Data stored in cloud services is highly sensitive and so access to it is controlled via policies written in domain-specific languages (DSLs). The expressiveness of these DSLs provides users flexibility to cover a wide variety of uses cases, however, unintended misconfigurations can lead to potential security issues. We introduce Block Public Access, a tool that formally verifies policies to ensure that they only allow access to trusted principals, i.e. that they prohibit access to the general public. To this end, we formalize the notion of Trust Safety that formally characterizes whether or not a policy allows unconstrained (public) access. Next, we present a method to compile the policy down to a logical formula whose unsatisfiability can be (1) checked by SMT and (2) ensures Trust Safety. The constructs of the policy DSLs render unsatisfiability checking PSPACE-complete, which precludes verifying the millions of requests per second seen at cloud scale. Hence, we present an approach that leverages the structure of the policy DSL to compute a much smaller residual policy that corresponds only to untrusted accesses. Our approach allows Block Public Access to, in the common case, syntactically verify Trust Safety without having to query the SMT solver. We have implemented Block Public Access and present an evaluation showing how the above optimization yields a low-latency policy verifier that the S3 team at AWS has integrated into their authorization system, where it is currently in production, analyzing millions of policies everyday to ensure that client buckets do not grant unintended public access.

Article Free Access Share on Instruction level profiling and evaluation of the IBM/6000 Authors: Chriss Stephens Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PA Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PAView Profile , Bryce Cogswell Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PA Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PAView Profile , John Heinlein Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PA Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PAView Profile , Gregory Palmer Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PA Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PAView Profile , John P. Shen Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PA Center for Dependable Systems, Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PAView Profile Authors Info & Claims ISCA '91: Proceedings of the 18th annual international symposium on Computer architectureApril 1991Pages 180–189https://doi.org/10.1145/115952.115971Published:01 April 1991Publication History 30citation385DownloadsMetricsTotal Citations30Total Downloads385Last 12 Months38Last 6 weeks4 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

The design and implementation of a high-performance special-purpose processor, called the White Dwarf, or accelerating finite-element analysis algorithms is presented. The White Dwarf CPU contains two Am2935 32-bit floating-point processors and one Am29332 32-bit arithmetic logic unit (ALU), and uses a wide-instruction-word architecture in which the application algorithm is directly implemented in microcode. The entire system is VME-bus compatible and interfaces with a Sun 3/160 host. The system's potential peak performance is 20 MFLOPS (million floating-point operations per second) a sustained computation rate in excess of 15 MFLOPS is expected. A potential speedup of between one and two orders of magnitude is possible. With a fully populated memory subsystem, the White Dwarf can accommodate finite-element problems involving up to half a million nodes. The system is designed using an approach called application-specific processor design (ASPD). A retargetable compiler has been developed which is capable of generating highly parallel and efficient code for the White Dwarf and other processors with similar architecture. System debug/integration is in progress; a highly useful system is expected.>