Riverbed: Enforcing User-defined Privacy Constraints in Distributed Web Services
summary
Riverbed implements a transparent Riverbed proxy that tags client data with simple policies and a taint-tracking Python runtime that enforces them; policies name allowed TLS hosts, disk/network sinks, and whether aggregation is permitted. Server-side universes are created by universe cloning (container instances) so each universe only holds data with the same policy. Remote attestation proves the runtime is trusted. Prototype shows taint tracking adds ~19% CPU overhead on microbenchmarks, paper reports modest slowdowns (~10%) on real apps, and 16 GB hosts comfortably hold ≈150 universes before swapping.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:12The Problem
- 6:30The Goal
- 6:49UserDefined Policies
- 9:46Millennials
- 10:26Alice Bob
- 13:43Remote attestation
- 15:27Recap
- 16:27Experimental Results
- 17:49Memory Pressure
- 18:45Conclusion
related talks
22mDynamic Policy Enforcement for Privacy Techniques in Microservice Architectures
18mSecure RDTs: Enforcing Access Control Policies for Offline Available JSON Data
22mPortunus: Re-imagining Access Control in Distributed Systems
24mData’s Rotten Scoundrels – How To Avoid Becoming One
28mThoth: Comprehensive Policy Compliance in Data Retrieval Systems
28mPrivacy Engineering Networking Break AMA
01h 04mAcademic sessions privacy and surveillance
21mR2P2: Making RPCs first-class datacenter citizens