Securing Public Cloud Networks with Efficient Role-based Micro-Segmentation (ZTS)#
NSDI '25 digest Program Core pick 28–30 April 2025
- Authors / tier: Sathiya Kumaran Mani, Kevin Hsieh (Microsoft); Santiago Segarra (Rice); Ranveer Chandra (Microsoft); Yajie Zhou (University of Maryland); Srikanth Kandula (Microsoft). Core.
- Why: Micro-segmentation is the canonical zero-trust control for limiting blast radius, but authoring precise policies at cloud scale is the perennial blocker. This sits squarely in network security and is grounded in real deployment.
- What: ZTS (Zero Trust Segmentation) ingests large volumes of flow logs, infers endpoint roles, and generates micro-segmentation policies automatically, with continuous communication-graph generation and policy enforcement.
- How: Role inference combines domain knowledge with communication patterns rather than relying on manual tagging (which breaks as pods migrate or scale). Evaluated against ground truth across 11 first- and third-party deployments; reported up to 21.5x more cost-efficient than Apache Flink for the stream-processing workload, with higher role-inference accuracy than prior algorithms.
- Where applicable: Large public-cloud networks; built and evaluated inside Microsoft's environment, so the productized form is Azure-flavored, but the role-inference approach is general.