A Framework for Automatically Enforcing Privacy Policies

A Framework for Automatically

Enforcing Privacy PoliciesJean Yang

MSRC / October 15, 2013

Privacy matters.People get it wrong.

Many possible points of failure.

getLocation(user)

findAllUsers(location)

findTopLocations()

Only friends can see GPS

location.

Desired Policy

Policy

Implementation

Policy

Policy

Increasingly complex policies.


location.

Desired Policy

who are localwithin next five hours

Jean Yang / Jeeves 5

Easier if we separate policies from other functionality.

getLocation(user)

findAllUsers(location)

findTopLocations()


location.

Policy Implementation Other Implementation


| findAllUsers(MSRC)

The Jeeves Language

k

You have no friends in this location.


Associated withpolicies.

val loc = gpsCoords | country(gpsCoords)a

label a

Core Functionalityval msg = “Jean’s location is ” + asStr(loc)

Contextual Enforcementprint {andrey} msg “Jean’s location is N 52.19, W 0.13.”print {rishabh} msg “Jean’s location is in the United Kingdom.”

Policiesrestrict a: loc.(isNear(oc, jean))

{ low, high }

9

Sensitive Values

Jean Yang / Jeeves

Label.

Label.

Output channel. Predicate.

High value. Low value.


Jeeves Execution

=

3

Faceted execution

3 | 0 a

true | false a

Storing policies

Policies

label arestrict a: loc.true

Constraintsprint {…} …true a = low

a loc.true

false


restrict a: loc.isNear(oc,me)

Policies may refer to sensitive values.

Jeeves Policies

loc.addConstraint( isNear(oc, me) a == low)

Constraints always take this form.

Notes• There is always a consistent assignment.

• Notion of maximal functionality: if a label is allowed to be high, we try to set it to high.



Classical SecurityLevel 3:

top secret.

Level 2:highly classified.

Level 1:privileged information.

Lattice of access levels.


Classical Security

Viewers must have access for the highest level.

+Level 3

Level 3

Level 0


| Jeeves Security

p+


Jeeves Non-InterferenceGuarantee

H | L a

Given a sensitive value

all executions where a must be low produce equivalent outputs no matter the value of H.

Takes into account when label depends on sensitive values!


Non-Interferencein Jeeves

restrict a: loc.(distance(oc, location) < 25)

protected location

viewer

Viewer within radius:a is allowed to be high.


Non-Interferencein Jeeves

restrict a: loc.(distance(oc, location) < 25)

protected location

Viewer outside radius:a must be low.Viewer should not be able to distinguish actual location from any other of these points.

viewer



ImplementationOverload operators for faceted evaluation.

Policy environment

Use an SMT solver as a model finder.

print

mkLabelrestrict

=

33 | 42 a

Store policies in runtime environment

true | false a

false


Case study: JConfJConf

policiesJConf

functionality

Reviewer Author


UserRole

PaperTitleAuthorReviewsTags…

Policy

Policy

Policy

ReviewReviewerContent

Policy

Policy

ContextUserStage

Polic

y

Policy

Core Program•Search papers.•Display papers.•Add and remove tags.•Assign and submit reviews.Fu

nctio

nalit

yJconf Architecture


Functionality vs. PolicyFile Total LOC Policy LOCConfUser.scala 212 21PaperRecord.scala 304 75PaperReview.scala 116 32ConfContext.scala 6 0Backend + Squeryl 800 0

Frontend (Scalatra) 629 0

Frontend (SSP) 798 0

Total 2865 128< 5%


SQL(Squeryl)Embedded

DSL

Scalatra frontend

PostGreSQLEmbedded

DSL

Django frontend

Jeeves Frameworks

Python-Jeeves

source transform


What about inputs?

Reviewer A

Reviews

New review

Reviewer B

New review

---

Author


Reviewer A

Reviews

New review

Reviewer B

New review

Old review

Author

Storing multiple versions?


Scores

New score

New score

Old score

UserUser

User

---

User

When viewers specify trust…

Need to additionally track who is writing…


Low-level mechanism

Mutable State

424242

p1

p2

p2

Associate references with policies

wrestrict lin.lout. ((in == alice) && isFriends (out, alice))

wrestrict lin.lout.(isFriends(in, alice))


Execution with writer’s inputs

Execution without writer’s inputs

New score

Guarantees


Write Policy Case Studies

Authentication Battleship game

Conference management

Notes• Support policies for confidentiality and integrity.

• Policy-agnosticism good for encoding other policies, for instance game rules.


|

select * from paperswhere author = “Jean Yang”

authorhigh authorlow policies

p

Interfacing with the DB

32

FINALLY.. I CAN FOCUS ON FUNCTIONALITY!


Jeeves Team

Armando Solar-

LezamaThomas Austin

Cormac Flanagan

TravisHance

BenjaminShaibu

| Program

The Jeeves Framework

k


Customized page

Customized page

jeeveslang.org

Documents

A Framework for Automatically Enforcing Privacy Policies