A language for automatically enforcing privacy policies

Abstract

It is becoming increasingly important for applications to protect sensitive data. With current techniques, the programmer bears the burden of ensuring that the application's behavior adheres to policies about where sensitive values may flow. Unfortunately, privacy policies are difficult to manage because their global nature requires coordinated reasoning and enforcement. To address this problem, we describe a programming model that makes the system responsible for ensuring adherence to privacy policies. The programming model has two components: 1) core programs describing functionality independent of privacy concerns and 2) declarative, decentralized policies controlling how sensitive values are disclosed. Each sensitive value encapsulates multiple views; policies describe which views are allowed based on the output context. The system is responsible for automatically ensuring that outputs are consistent with the policies. We have implemented this programming model in a new functional constraint language named Jeeves. In Jeeves, sensitive values are introduced as symbolic variables and policies correspond to constraints that are resolved at output channels. We have implemented Jeeves as a Scala library using an SMT solver as a model finder. In this paper we describe the dynamic and static semantics of Jeeves and the properties about policy enforcement that the semantics guarantees. We also describe our experience implementing a conference management system and a social network.

Finding security bugs in web applications using a catalog of access control patterns

“…NICE-PySE [8] and Commuter [12] both implement library-based symbolic execution in Python, but only for particular domain-specific languages. Yang et al [36] and Köskal et al [21] use the same technique in Scala, but to enforce security policies and perform constraint programming, respectively. Rosette [35] uses a library to symbolically execute Racket for verification and program synthesis.…”

“…Resin [37] is a runtime system that enforces information flow policies attached to data objects; it has been successfully applied to web applications. Jeeves [36], a similar language for enforcing information flow policies, has also been applied to the web. Jif [23], an extension of Java, also supports checking policies at runtime.…”

CoSMed: A Confidentiality-Verified Social Media Platform

“…Finally, there are quite a few programming languages and tools aimed at supporting information-flow secure programming [2, 3,7,30], as well as information-flow tracking tools for the client side of web applications [6,8,14]. We foresee a future where such tools will cooperate with proof assistants to offer light-weight guarantees for free and stronger guarantees (like the ones we proved in this paper) on a need basis.…”

CoSMeDis: A Distributed Social Media Platform with Formally Verified Confidentiality Guarantees

“…Control of declassification is limited to where in the program declassification may occur. Jeeves [64] extends a core language for functionality with a language for flexible security policies. RF [11] uses a relational Hoare logic to reason about 2-safety properties of probabilistic programs, including language-based notions of information flow security.…”