Contextual and Granular Policy Enforcement in Database-backed Applications

Abstract

Database-backed applications rely on inlined policy checks to process users' private and confidential data in a policy-compliant manner as traditional database access control mechanisms cannot enforce complex policies. However, application bugs due to missed checks are common in such applications, which result in data breaches. While separating policy from code is a natural solution, many data protection policies specify restrictions based on the context in which data is accessed and how the data is used. Enforcing these restrictions automatically presents significant challenges, as the information needed to determine context requires a tight coupling between policy enforcement and an application's implementation. We present Estrela, a framework for enforcing contextual and granular data access policies. Working from the observation that API endpoints can be associated with salient contextual information in most database-backed applications, Estrela allows developers to specify API-specific restrictions on data access and use. Estrela provides a clean separation between policy specification and the application's implementation, which facilitates easier auditing and maintenance of policies. Policies in Estrela consist of pre-evaluation and post-evaluation conditions, which provide the means to modulate database access before a query is issued, and to impose finergrained constraints on information release after the evaluation of query, respectively. We build a prototype of Estrela and apply it to retrofit several real world applications (from 1000-80k LOC) to enforce different contextual policies. Our evaluation shows that Estrela can enforce policies with minimal overheads. CCS CONCEPTS • Security and privacy → Access control; Software security engineering; Web application security.

User-Controlled Privacy: Taint, Track, and Control

“…Many IFC languages have been developed, including JIF [61], FlowCaml [72], Jeeves [78], JSFlow [54], LWeb [64], and others [5,18,20,21,25,45,47,59,60,65,71,75]. Our work builds on two ideas from this field: dynamic information-flow [4,37,67,77] Table 3: Comparison of related work JIF [61] FlowCaml [72] SIF [21] SELinks [25] UrFlow [18] Jeeves [78] JSFlow [54] Jacqueline [77] JSLINQ [5] Hails [45] DAISY [47] LWeb [64] Riverbed [75] Estrela [11] Lifty [65] Storm [59] WebTTC…”

“…The dynamic IFC systems of Jeeves [78], Jacqueline [77], Hails [45], LWeb [64], and Estrela [11] rely on policies defined at the datamodel level. Hails [45] and LWeb [64] are based on Haskell monads, Estrela [11] on modifying database queries, and Jeeves [78] and Jacqueline [77] on a custom 𝜆 calculus.…”

“…The dynamic IFC systems of Jeeves [78], Jacqueline [77], Hails [45], LWeb [64], and Estrela [11] rely on policies defined at the datamodel level. Hails [45] and LWeb [64] are based on Haskell monads, Estrela [11] on modifying database queries, and Jeeves [78] and Jacqueline [77] on a custom 𝜆 calculus. In Jeeves and Jacqueline, sensitive values are evaluated either to their actual value or a default value according to the content of some level variable, which is set according to the application's policy.…”

Model-driven Privacy

“…However, a large gap remains between designs and the concrete system implementations. In contrast, approaches for enforcing data-usage policies [19,62] focus on the enforcement mechanism, making the policy statement implementation dependent and hence not a design artifact. Finally, there are approaches that do not propose any technical means for achieving privacyby-design, but rather report on experiences [39], analyze regulations [6], or exclusively work with system design models [5].…”