@article {83, title = {Analyzing the Power Consumption of the Mobile Page Load}, year = {2016}, author = {Yi Cao and Javad Nejati and Pavan Maguluri and Aruna Balasubramanian and Anshul Gandhi} } @conference {82, title = {Autoscaling for Hadoop Clusters}, year = {2016}, abstract = {

Unforeseen events such as node failures and re- source contention can have a severe impact on the performance of data processing frameworks, such as Hadoop, especially in cloud environments where such incidents are common. SLA compliance in the presence of such events requires the ability to quickly and dynamically resize infrastructure resources. Unfortunately, the distributed and stateful nature of data processing frameworks makes it challenging to accurately scale the system at run-time. In this paper, we present the design and implementation of a model-driven autoscaling solution for Hadoop clusters. We first develop novel gray-box performance models for Hadoop workloads that specifically relate job execution times to resource allocation and workload parameters. We then employ these models to dynamically determine the resources required to successfully complete the Hadoop jobs as per the user-specified SLA under various scenarios including node failures and multi-job executions. Our experimental results on three different Hadoop cloud clusters and across different workloads demonstrate the efficacy of our models and highlight their autoscaling capabilities.

}, author = {Anshul Gandhi and Sidhartha Thota and Parijat Dube and Andrzej Kochut and Li Zhang} } @conference {80, title = {Minimizing Electricity Cost for Geo-Distributed Interactive Services with Tail Latency Constraint}, year = {2016}, abstract = {

Cross-border data movement has become increas- ingly more costly, and even been prohibited due to data sovereignty requirements. Consequently, geo-distributed inter- active services, which rely on geographically distributed data sets, is quickly emerging as an important class of workloads in data centers and resulting in soaring electricity costs. While numerous geographic load balancing (GLB) techniques exist to exploit differences in electricity prices for cost savings, they do not apply to emerging geo-distributed interactive services due to two major limitations. First, they assume that each request is processed only in one data center, whereas each geo- distributed interactive request must be processed at multiple data centers simultaneously. Second, they primarily focus on meeting average latency constraints, whereas tail latencies (i.e., high- percentile latencies) are more suitable to ensure a consistently good user experience. In this paper, we make an early effort to optimize GLB decisions for geo-distributed interactive services, exploiting spatial diversity of electricity prices to minimize the total electricity cost while meeting a tail latency constraint. Our solution employs a novel data-driven approach to determine the tail latency performance for different GLB decisions, by profiling the network latency and data center latency at a low complexity. We run trace-based discrete-event simulations to validate our design, showing that it can reduce the electricity cost by more than 7\% while meeting the tail latency constraint compared to the performance-aware but cost-oblivious approach.

}, author = {Mohammad A. Islam and Anshul Gandhi and Shaolei Ren} } @conference {81, title = {Using Machine Learning for Black-Box Autoscaling}, year = {2016}, abstract = {

Autoscaling is the practice of automatically adding or removing resources for an application deployment to meet performance targets in response to changing workload conditions. However, existing autoscaling approaches typically require expert application and system knowledge to minimize resource costs and performance target violations, thus limiting their applicability. We present MLscale, an application-agnostic, machine learning based autoscaler that is composed of: (i) a neural network based online (black-box) performance modeler, and (ii) a regression based metrics predictor to estimate post-scaling application and system metrics. Implementation results for diverse applications across several traces highlight MLscale{\textquoteright}s application-agnostic behavior and show that MLscale (i) reduces resource costs by about 50\% compared to the optimal static policy, (ii) is within 15\% of the cost of the optimal dynamic policy, and (iii) provides similar cost-performance tradeoffs, without requiring any tuning, when compared to carefully tuned threshold-based policies.

}, author = {Muhammad Wajahat and Anshul Gandhi and Alexei Karve and Andrzej Kochut} } @article {26, title = {Dynamic Management of Caching Tiers}, year = {2014}, url = {http://www3.cs.stonybrook.edu/~anshul/icpe14.pdf}, author = {Anshul Gandhi} } @conference {33, title = {Jigsaw: Indoor Floor Plan Reconstruction via Mobile Crowdsensing}, booktitle = {20th Annual International Conference on Mobile Computing and Networking (MobiCom {\textquoteright}14)}, year = {2014}, month = {09/2014}, address = {Hawaii, USA}, abstract = {

The lack of floor plans is a critical reason behind the current sporadic availability of indoor localization service. Service providers have to go through effort-intensive and timeconsuming business negotiations with building operators, or hire dedicated personnel to gather such data. In this paper, we propose Jigsaw, a floor plan reconstruction system that leverages crowdsensed data from mobile users. It extracts the position, size and orientation information of individual landmark objects from images taken by users. It also obtains the spatial relation between adjacent landmark objects from inertial sensor data, then computes the coordinates and orientations of these objects on an initial floor plan. By combining user mobility traces and locations where images are taken, it produces complete floor plans with hallway connectivity, room sizes and shapes. Our experiments on 3 stories of 2 large shopping malls show that the 90-percentile errors of positions and orientations of landmark objects are about 1 \~{} 2m and 5 \~{} 9{\textopenbullet}, while the hallway connectivity is 100\% correct.

}, keywords = {indoor floor plan reconstruction; mobile crowdsensing}, url = {http://www.ece.sunysb.edu/~fanye/papers/jigsaw-mobicom14.pdf}, author = {Ruipeng Gao and Mingmin Zhao and Tao Ye and Fan Ye and Yizhou Wang and Kaigui Bian and Tao Wang and Xiaoming Li} } @conference {29, title = {Are sleep states effective in data centers?}, booktitle = {Third International Green Computing Conference (IGCC {\textquoteright}12)}, year = {2012}, abstract = {

While sleep states have existed for mobile devices and workstations for some time, these sleep states have not been incorporated into most of the servers in today{\textquoteright}s data centers. High setup times make data center administrators fearful of any form of dynamic power management, whereby servers are suspended or shut down when load drops. This general reluctance has stalled research into whether there might be some feasible sleep state (with sufficiently low setup overhead and/or sufficiently low power) that would actually be beneficial in data centers.

This paper investigates the regime of sleep states that would be advantageous in data centers. We consider the benefits of sleep states across three orthogonal dimensions: (i) the variability in the workload trace, (ii) the type of dynamic power management policy employed, and (iii) the size of the data center.

Our implementation results on a 24-server multi-tier test bed indicate that under many traces, sleep states greatly enhance dynamic power management. In fact, given the right sleep states, even a na{\i}ve policy that simply tries to match capacity with demand, can be very effective. By contrast, we characterize certain types of traces for which even the {\textquotedblleft}best{\textquotedblright} sleep state under consideration is ineffective. Our simulation results suggest that sleep states are even more beneficial for larger data centers. \ 

}, url = {http://www3.cs.stonybrook.edu/~anshul/igcc_2012.pdf}, author = {Anshul Gandhi and Mor Harchol-Balter and Michael Kozuch} } @article {27, title = {AutoScale: Dynamic, Robust Capacity Management for Multi-Tier Data Centers}, journal = {ACM Transactions on Computer Systems (TOCS {\textquoteright}12)}, volume = {30}, year = {2012}, month = {11/2012}, abstract = {

Energy costs for data centers continue to rise, already exceeding $15 billion yearly. Sadly much of this power is\ wasted. Servers are only busy 10-30\% of the time on average, but they are often left on, while idle, utilizing 60\% or more of peak power when in the idle state.

We introduce a dynamic capacity management policy,\ AutoScale, that greatly reduces the number of servers needed in data centers driven by unpredictable, time-varying load, while meeting response time SLAs.\ AutoScale\ scales the data center capacity, adding or removing servers as needed.\ AutoScale\ has two key features: (i) it autonomically maintains just the right amount of spare capacity to handle bursts in the request rate; and (ii) it is robust not just to changes in the request rate of real-world traces, but also\ request size\ and\ server efficiency.

We evaluate our dynamic capacity management approach via implementation on a 38-server multitier data center, serving a web site of the type seen in Facebook or Amazon, with a key-value store workload. We demonstrate that\ AutoScale\ vastly improves upon existing dynamic capacity management policies with respect to meeting SLAs and robustness.

}, keywords = {Data centers, power management, resource provisioning}, doi = {10.1145/2382553.2382556}, url = {http://www3.cs.stonybrook.edu/~anshul/tocs12.pdf}, author = {Anshul Gandhi and Mor Harchol-Balter and Ram Raghunathan and Michael Kozuch} } @article {30, title = {Hybrid Resource Provisioning for Minimizing Data Center SLA Violations and Power Consumption}, journal = {Sustainable Computing, Informatics and Systems}, volume = {2}, year = {2012}, pages = {14}, chapter = {91}, abstract = {

This paper presents a practical and systematic approach to correctly provision server resources in data centers, such that SLA violations and energy consumption are minimized. In particular, we describe a hybrid method for server provisioning. Our method first applies a novel discretization technique on his- torical workload traces to identify long-term workload demand patterns that establish a {\textquotedblleft}base{\textquotedblright} load. It then employs two techniques to dynamically allocate capacity: predictive provisioning handles the pre- dicted base load at coarse time scales (e.g., hours) and reactive provisioning handles any excess workload at finer time scales (e.g., minutes). The combination of predictive and reactive provisioning achieves a significant improvement in meeting SLAs, conserving energy and reducing provisioning cost. We implement and evaluate our approach using traces from four production systems. The results show that our approach can provide up to 35\% savings in power consumption and reduce SLA violations by as much as 21\% compared to existing techniques, while avoiding frequent power cycling of servers. \ 

}, keywords = {power management, resource provisioning, Sustainable computing, Workload analysis}, doi = {10.1016/j.suscom.2012.01.005}, url = {http://www3.cs.stonybrook.edu/~anshul/suscom.pdf}, author = {Anshul Gandhi and Yuan Chen and Daniel Gmach and Martin Arlitt and Manish Marwah} } @conference {61, title = {Power Consumption in Enterprise-Scale Backup Storage Systems}, booktitle = {USENIX Conference on File and Storage Technologies (FAST {\textquoteright}12)}, year = {2012}, month = {02/2012}, publisher = {USENIX Association}, organization = {USENIX Association}, address = {San Jose, CA}, abstract = {

Power consumption has become an important factor in modern storage system design. Power efficiency is particularly beneficial in disk-based backup systems that store mostly cold data, have significant idle periods, and must compete with the operational costs of tape-based backup. There are no prior published studies on power consumption in these systems, leaving researchers and practitioners to rely on existing assumptions. In this paper we present the first analysis of power consumption in real-world, enterprise, disk-based backup storage systems. We uncovered several important observations, including some that challenge conventional wisdom. We discuss their impact on future power-efficient designs.

}, url = {http://www.fsl.cs.stonybrook.edu/docs/fast-emc-energy/power_management.pdf}, author = {Z. Li and K. M. Greenan and A. W. Leung and E. Zadok} } @conference {28, title = {Saving Cash by Using Less Cache}, booktitle = {4th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud {\textquoteright}12)}, year = {2012}, abstract = {
Everyone loves a large caching tier in their multi-tier cloud-based web service because it both alleviates\ database load and provides lower request latencies. Even\ when load drops severely, administrators are reluctant to\ scale down their caching tier. This paper makes the case\ that (i) scaling down the caching tier is viable with re-\ spect to performance, and (ii) the savings are potentially\ huge; e.g., a 4x drop in load can result in 90\% savings in\ the caching tier size.
}, url = {http://www3.cs.stonybrook.edu/~anshul/hotcloud_2012.pdf}, author = {Timothy Zhu and Anshul Gandhi and Mor Harchol-Balter and Michael Kozuch} } @conference {23, title = {SOFTScale: Stealing Opportunistically For Transient Scaling}, booktitle = {13th International Middleware Conference (Middleware {\textquoteright}12)}, year = {2012}, abstract = {

Dynamic capacity provisioning is a well studied approach to handling gradual changes in data center load. However, abrupt spikes in load are still problematic in that the work in system rises very quickly during the setup time needed to turn on additional capacity. Performance can be severely affected even if it takes only 5 seconds to bring additional capacity online.

In this paper, we propose SOFTScale, an approach to handling load spikes in multi-tier data centers without having to over-provision resources. SOFTScale works by opportunistically stealing resources from other tiers to alleviate the bottleneck tier, even when the tiers are carefully provisioned at capacity. SOFTScale is especially useful during the transient overload periods when additional capacity is being brought online.

Via implementation on a 28-server multi-tier testbed, we investigate a range of possible load spikes, including an artificial doubling or tripling of load, as well as large spikes in real traces. We find that SOFTScale can meet our stringent response time Service Level Agreement goal of 500ms without using any additional resources even under some extreme load spikes that would normally cause the system (without SOFTScale) to exhibit response times as high as 96 seconds.

}, keywords = {Data centers, load spikes, power management, resource provisioning}, url = {http://www3.cs.stonybrook.edu/~anshul/middleware12.pdf}, author = {Anshul Gandhi and Timothy Zhu and Mor Harchol-Balter and Michael Kozuch} } @conference {37, title = {The case for sleep states in servers}, booktitle = {4th Workshop on Power-Aware Computing (HotPower {\textquoteright}11)}, year = {2011}, abstract = {

While sleep states have existed for mobile devices and workstations for some time, these sleep states have largely not been incorporated into the servers in today{\textquoteright}s data centers.

Chip designers have been unmotivated to design sleep states because data center administrators haven{\textquoteright}t expressed any desire to have them. High setup times make administrators fearful of any form of dynamic power management, whereby servers are suspended or shut down when load drops. This general reluctance has stalled research into whether there might be some feasible sleep state (with sufficiently low setup overhead and/or sufficiently low power) that would actually be beneficial in data centers.

This paper uses both experimentation and theory to investigate the regime of sleep states that should be advantageous in data centers. Implementation experiments involve a 24-server multi-tier test bed, serving a web site of the type seen in Facebook or Amazon with key-value workload and a range of hypothetical sleep states. Analytical modeling is used to understand the effect of scaling up to larger data centers. The goal of this research is to encourage data center administrators to consider dynamic power management and to spur chip designers to develop useful sleep states for servers. \ 

}, url = {http://www3.cs.stonybrook.edu/~anshul/hotpower_2011.pdf}, author = {Anshul Gandhi and Mor Harchol-Balter and Michael Kozuch} } @conference {39, title = {Distributed, Robust Auto-Scaling Policies for Power Management in Compute Intensive Server Farms}, booktitle = {Sixth Open Cirrus Summit (OCS {\textquoteright}11)}, year = {2011}, abstract = {

Server farms today often over-provision resources to handle peak demand, resulting in an excessive waste of power. Ideally, server farm capacity should be dynamically adjusted based on the incoming demand. However, the unpredictable and time-varying nature of customer demands makes it very difficult to efficiently scale capacity in server farms. The problem is further exacerbated by the large setup time needed to increase capacity, which can adversely impact response times as well as utilize additional power.

In this paper, we present the design and implementation of a class of Distributed and Robust Auto-Scaling policies (DRA S policies), for power management in compute intensive server farms. Results indicate that the DRAS policies dynamically adjust server farm capacity without requiring any prediction of the future load, or any feedback control. Implementation results on a 21 server test-bed show that the DRAS policies provide near-optimal response time while lowering power consumption by about 30\% when compared to static provisioning policies that employ a fixed number of servers.

}, url = {http://www3.cs.stonybrook.edu/~anshul/opencirrus_2011.pdf}, author = {Anshul Gandhi and Mor Harchol-Balter and Ram Raghunathan and Michael Kozuch} } @conference {63, title = {On the Energy Consumption and Performance of Systems Software}, booktitle = {4th Israeli Experimental Systems Conference (ACM SYSTOR {\textquoteright}11)}, year = {2011}, month = {06/2011}, address = {Haifa, Israel}, abstract = {

Models of energy consumption and performance are necessary to understand and identify system behavior, prior to designing advanced controls that can balance out performance and energy use. This paper considers the energy consumption and performance of servers running a relatively simple file-compression workload. We found that standard techniques for system identification do not produce acceptable models of energy consumption and performance, due to the intricate interplay between the discrete nature of software and the continuous nature of energy and performance. This motivated us to perform a detailed empirical study of the energy consumption and performance of this system with varying compression algorithms and compression levels, file types, persistent storage media, CPU DVFS levels, and disk I/O schedulers. Our results identify and illustrate factors that complicate the system{\textquoteright}s energy consumption and performance, including nonlinearity, instability, and multi-dimensionality. Our results provide a basis for future work on modeling energy consumption and performance to support principled design of controllable energy-aware systems.

}, url = {http://www.fsl.cs.stonybrook.edu/docs/erss11model/erss11model.pdf}, author = {Zhichao L and Radu Grosu and Priya Sehgal and Scott A. Smolka and Scott D. Stoller and Erez Zadok} } @conference {40, title = {How Data Center Size Impacts the Effectiveness of Dynamic Power Management}, booktitle = {49th Annual Allerton Conference on Communication, Control, and Computing}, year = {2011}, abstract = {

Power consumption accounts for a significant portion of a data center{\textquoteright}s operating expenses. Sadly, much of this power is wasted by servers that are left on even when there is no work to do. Dynamic power management aims to reduce power wastage in data centers by turning servers off when they are not needed. However, turning a server back on requires a setup time, which can adversely affect system performance. Thus, it is not obvious whether dynamic power management should be employed in a data center. In this paper, we analyze the effectiveness of dynamic power management in data centers under an M/M/k model via Matrix- analytic methods. We find that the effectiveness of even the simplest dynamic power management policy increases with the data center size, surpassing static power management when the number of servers exceeds 50, under realistic setup costs and server utilizations. Furthermore, we find that a small enhancement to traditional dynamic power management, involving delaying the time until a server turns off, can yield benefits over static power management even for data center sizes as small as 4 servers. \ 

}, url = {http://www3.cs.stonybrook.edu/~anshul/allerton_2011.pdf}, author = {Anshul Gandhi and Mor Harchol-Balter} } @conference {38, title = {Minimizing Data Center SLA Violations and Power Consumption via Hybrid Resource Provisioning}, booktitle = {International Green Computing Conference and Workshops (IGCC {\textquoteright}11)}, year = {2011}, abstract = {

This paper presents a novel approach to correctly allocate resources in data centers, such that SLA violations and energy consumption are minimized. Our approach first analyzes historical workload traces to identify long-term patterns that establish a {\textquotedblleft}base{\textquotedblright} workload. It then employs two \ techniques to dynamically allocate capacity: predictive \ provisioning handles the estimated base workload at coarse \ time scales (e.g., hours or days) and reactive provisioning \ handles any excess workload at finer time scales (e.g., minutes). \ 

The combination of predictive and reactive provisioning achieves a significant improvement in meeting SLAs, conserving energy, and reducing provisioning costs. We implement and evaluate our approach using traces from four production systems. The results show that our approach can provide up to 35\% savings in power consumption and reduce SLA violations by as much as 21\% compared to existing techniques, while avoiding frequent power cycling of servers

}, keywords = {Data centers, performance management, power management, resource allocation}, url = {http://www3.cs.stonybrook.edu/~anshul/igcc_2011.pdf}, author = {Anshul Gandhi and Yuan Chen and Daniel Gmach and Martin Arlitt and Manish Marwah} } @conference {62, title = {Model Discovery for Energy-Aware Computing Systems: An Experimental Evaluation}, booktitle = {1st Workshop on Energy Consumption and Reliability of Storage Systems (ERSS {\textquoteright}11)}, year = {2011}, month = {07/2011}, address = {Orlando, FL}, abstract = {
We present a model-discovery methodology for energy-aware computing systems that achieves high prediction accuracy. Model discovery, or system identification, is a critical first step in designing advanced controllers that can dynamically manage the energy-performance trade-off in an optimal manner. Our methodology favors Multiple-Inputs-Multiple-Outputs (MIMO) models over a collection of Single-Input-Single-Output (SISO) models, when the inputs and outputs of the system are coupled in a nontrivial way. In such cases, MIMO is generally more accurate than SISO over a wide range of inputs in predicting system behavior. Our experimental evaluation, carried out on a representative server workload, validates our approach. We obtained an average prediction accuracy of 77\% and 76\% for MIMO power and performance, respectively. We also show that MIMO models are consistently more accurate than SISO ones.
}, url = {http://www.fsl.cs.stonybrook.edu/docs/erss11model/erss11model.pdf}, author = {Zhichao Li and Radu Grosu and Koundinya Muppalla and Scott A. Smolka and Scott D. Stoller and Erez Zadok} } @proceedings {47, title = {Understanding network failures in data centers: measurement, analysis, and implications}, year = {2011}, month = {01/2011}, pages = {350-361 }, publisher = {ACM}, abstract = {

We present the first large-scale analysis of failures in a data center network. Through our analysis, we seek to answer several fundamental questions: which devices/links are most unreliable, what causes failures, how do failures impact network traffic and how effective is network redundancy? We answer these questions using multiple data sources commonly collected by network operators. The key findings of our study are that (1) data center networks show high reliability, (2) commodity switches such as ToRs and AggS are highly reliable, (3) load balancers dominate in terms of failure occurrences with many short-lived software related faults,(4) failures have potential to cause loss of many small packets such as keep alive messages and ACKs, and (5) network redundancy is only 40\% effective in reducing the median impact of failure.

}, keywords = {Network Management, Network Services, Networks}, isbn = {978-1-4503-0797-0 }, doi = {10.1145/2018436.2018477 }, url = {http://dl.acm.org/citation.cfm?id=2018436.2018477\&coll=DL\&dl=ACM\&CFID=448744458\&CFTOKEN=88236964}, author = {Phillipa Gill and Navendu Jain and Nachiappan Nagappan} } @article {43, title = {Optimality analysis of energy-performance trade-off for server farm management}, journal = {Performance Evaluation}, volume = {67}, year = {2010}, month = {11/2010}, chapter = {1155}, abstract = {

A central question in designing server farms today is how to efficiently provision the number of servers to extract the best performance under unpredictable demand patterns while not wasting energy. While one would like to turn servers off when they become idle to save energy, the large setup cost (both, in terms of setup time and energy penalty) needed to switch the server back on can adversely affect performance. The problem is made more complex by the fact that today{\textquoteright}s servers provide multiple sleep or standby states which trade off the setup cost with the power consumed while the server is {\textquoteleft}sleeping{\textquoteright}. With so many controls, finding the optimal server farm management policy is an almost intractable problem {\textemdash} How many servers should be on at any given time, how many should be off, and how many should be in some sleep state?

In this paper, we employ the popular metric of Energy-Response time Product (ERP) to capture the energy-performance trade-off, and present the first theoretical results on the optimality of server farm management policies. For a stationary demand pattern, we prove that there exists a very small, natural class of policies that always contains the optimal policy for a single server, and conjecture it to contain a near-optimal policy for multi-server systems. For time-varying demand patterns, we propose a simple, traffic-oblivious policy and provide analytical and empirical evidence for its near-optimality.

}, doi = {10.1016/j.peva.2010.08.009}, url = {http://www3.cs.stonybrook.edu/~anshul/perf_power_2010.pdf}, author = {Anshul Gandhi and Varun Gupta and Mor Harchol-Balter and Michael Kozuch} } @article {42, title = {Server farms with setup costs}, journal = {Performance Evaluation}, volume = {67}, year = {2010}, month = {11/2010}, chapter = {1123}, abstract = {

In this paper we consider server farms with a setup cost. This model is common in manufacturing systems and data centers, where there is a cost to turn servers on. Setup costs always take the form of a time delay, and sometimes there is additionally a power penalty, as in the case of data centers. Any server can be either on, off, or in setup mode. While prior work has analyzed single servers with setup costs, no analytical results are known for multi-server systems. In this paper, we derive the first closed-form solutions and approximations for the mean response time and mean power consumption in server farms with setup costs. We also analyze variants of server farms with setup, such as server farm models with staggered boot up of servers, where at most one server can be in setup mode at a time, or server farms with an infinite number of servers. For some variants, we find that the distribution of response time can be decomposed into the sum of response time for a server farm without setup and the setup time. Finally, we apply our analysis to data centers, where both response time and power consumption are key metrics. Here we analyze policy design questions such as whether it pays to turn servers off when they are idle, whether staggered boot up helps, how to optimally mix policies, and other questions related to the optimal data center size.

}, keywords = {Data centers, M/M/k, power management, Setup times, Staggered boot up}, doi = {10.1016/j.peva.2010.07.004}, url = {http://www3.cs.stonybrook.edu/~anshul/perf_mmk_2010.pdf}, author = {Anshul Gandhi and Mor Harchol-Balter and Ivo Adan} } @book {54, title = {Verification of Security Policy Enforcement in Enterprise Systems}, series = {Emerging Challenges for Security, Privacy and Trust }, number = {297}, year = {2009}, pages = {202-213}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, edition = {2009}, abstract = {

Many security requirements for enterprise systems can be expressed in a natural way as high-level access control policies. A high-level policy may refer to abstract information resources, independent of where the information is stored; it controls both direct and indirect accesses to the information; it may refer to the context of a request, i.e., the request{\textquoteright}s path through the system; and its enforcement point and enforcement mechanism may be unspecified. Enforcement of a high-level policy may depend on the system architecture and the configurations of a variety of security mechanisms, such as firewalls, host login permissions, file permissions, DBMS access control, and application-specific security mechanisms. This paper presents a framework in which all of these can be conveniently and formally expressed, a method to verify that a high-level policy is enforced, and an algorithm to determine a trusted computing base for each resource.

}, isbn = {978-3-642-01243-3}, doi = {10.1007/978-3-642-01244-0_18}, url = {http://link.springer.com/chapter/10.1007\%2F978-3-642-01244-0_18}, author = {Puneet Gupta and Scott Stoller} }