A language for automatically enforcing privacy policies

Abstract

It is becoming increasingly important for applications to protect sensitive data. With current techniques, the programmer bears the burden of ensuring that the application's behavior adheres to policies about where sensitive values may flow. Unfortunately, privacy policies are difficult to manage because their global nature requires coordinated reasoning and enforcement. To address this problem, we describe a programming model that makes the system responsible for ensuring adherence to privacy policies. The programming model has two components: 1) core programs describing functionality independent of privacy concerns and 2) declarative, decentralized policies controlling how sensitive values are disclosed. Each sensitive value encapsulates multiple views; policies describe which views are allowed based on the output context. The system is responsible for automatically ensuring that outputs are consistent with the policies. We have implemented this programming model in a new functional constraint language named Jeeves. In Jeeves, sensitive values are introduced as symbolic variables and policies correspond to constraints that are resolved at output channels. We have implemented Jeeves as a Scala library using an SMT solver as a model finder. In this paper we describe the dynamic and static semantics of Jeeves and the properties about policy enforcement that the semantics guarantees. We also describe our experience implementing a conference management system and a social network.

A system for collecting and analyzing experience sampling data

“…JEEVES; Yang, Yessenov & Solar-Lezama, 2012), the privacy status of variables can be declared, but whenever a statement is executed involving such a variable computation must be forked (at least conceptually and often in practice) to account for the different trajectories that the code may have taken based on protected values. These forks can be computationally 4 Note that we are not claiming that JAGS is the only language that meets these criterions and other languages such as STAN or PyMC3 could have been used.…”

Racets: Faceted Execution in Racket

“…At the same time, Yang et al rst implemented Jeeves, a language allowing policy-agnostic programming [23]. Policy-agnostic programming takes the view that programs should be wri en without regard to a particular privacy policy, because as the policy changes, correctly updating program logic is cumbersome and error-prone.…”

Fabric: Building open distributed systems securely by construction

“…Fabric fits into a substantial history of efforts to integrate information flow control into practical language-level programming abstractions; prior systems include SPARK/Ada [11], Jif and Jif/split [87,90,131,137], FlowCaml [113], Laminar [105], Aura [58], Swift [27], LIO [117], Jeeves [129], and Paragon [20]. These previous systems are either not distributed, or provide much more limited control over distributed computation.…”