Faceted execution of policy-agnostic programs

Abstract

It is important for applications to protect sensitive data. Even for simple confidentiality and integrity policies, it is often difficult for programmers to reason about how the policies should interact and how to enforce policies across the program. A promising approach is policy-agnostic programming, a model that allows the programmer to implement policies separately from core functionality. Yang et al. describe Jeeves [48], a programming language that supports information flow policies describing how to reveal sensitive values in different output channels. Jeeves uses symbolic evaluation and constraint-solving to produce outputs adhering to the policies. This strategy provides strong confidentiality guarantees but limits expressiveness and implementation feasibility.We extend Jeeves with faceted values [6], which exploit the structure of sensitive values to yield both greater expressiveness and to facilitate reasoning about runtime behavior. We present a faceted semantics for Jeeves and describe a model for propagating multiple views of sensitive information through a program. We provide a proof of termination-insensitive non-interference and describe how the semantics facilitate reasoning about program behavior.

Precise, dynamic information flow for database-backed applications

“…While previous implementations of Jeeves [7,48] use Scala, we implement Jacqueline in Python, as an extension of Django [1], because of the popularity of both for web programming. Our code is available at https://github.com/ jeanqasaur/jeeves.…”

“…This is because leaks often involve the results of computations on sensitive values, rather than sensitive values themselves. To reduce the opportunity for inadvertent leaks, we present a policy-agnostic approach [7,48]. Using this approach, the programmer factors out the implementation of information flow policies from application code and database queries.…”

“…We extend prior work on the Jeeves programming language [7,48] that defines a policyagnostic semantics for a simple imperative language. As is common with language-based approaches, Jeeves's guarantees extend only within the Jeeves runtime.…”

Variational Data Structures

“…For example, Chen et al have shown how variational types can be used to recover from type errors during type inference [13] and improve the quality of type errors [12]. Similarly, variational data structures can support the efficient simulation of all possibilities in alternative programming models, such as probabilistic computing; to track context information that controls an algorithm, as in context-oriented programming [26]; or to maintain alternative views of sensitive values corresponding to different privacy policies [6,7,46].…”

“…Toward efficiently testing all variants, several researchers have explored executing a program on variational inputs by lifting a corresponding interpreter [33,34,37,45]. Variational interpreters have also been employed for computing with alternative privacy policies [6,7,46]. Values in the store of a variational interpreter are represented by variational data types.…”