Preventing information leaks with policy-agnostic programming
نویسنده
چکیده
As a solution to the problem of information leaks, I propose a policy-agnostic programming paradigm that enforces security and privacy policies by construction. I present the implementation of this paradigm in a new language, Jeeves, that automatically enforces information flow policies describing how sensitive values may flow through computations. In Jeeves, the programmer specifies expressive information flow policies separately from other functionality and relies on the language runtime to customize program behavior based on the policies. Jeeves allows programmers to implement information flow policies once instead of as repeated checks and filters across the program. To provide strong guarantees about Jeeves programs, I present a formalization of the dynamic semantics of Jeeves, define non-interference and policy compliance properties, and provide proofs that Jeeves enforces these properties. To demonstrate the practical feasibility of policy-agnostic programming, I present Jacqueline, a web framework built on Jeeves that enforces policies in database-backed web applications. I provide a formalization of Jacqueline as an extension of Jeeves to include relational operators and proofs that this preserves the policy compliance guarantees. Jacqueline enforces information flow policies end-to-end and runs using an unmodified Python interpreter and SQL database. I show, through several case studies, that Jacqueline reduces the amount of policy code required while incurring limited overheads. Thesis Supervisor: Armando Solar-Lezama Title: Associate Professor without Tenure
منابع مشابه
Faceted execution of policy-agnostic programs Citation
It is important for applications to protect sensitive data. Even for simple confidentiality and integrity policies, it is often difficult for programmers to reason about how the policies should interact and how to enforce policies across the program. A promising approach is policy-agnostic programming, a model that allows the programmer to implement policies separately from core functionality. ...
متن کاملEnd-To-End Policy-Agnostic Security for Database-Backed Applications
Protecting sensitive data often requires implementing repeated secu rity checks and filters throughout a program. This task is especially error-prone in web programs, where data flows between applica tions and databases. To reduce the opportunity for privacy leaks, we present Jacqueline, a web framework that automatically enforces se curity policies that restrict where sensitive data may flo...
متن کاملLanguage-Based Enforcement of Privacy Policies
We develop a language-based approach for modeling and verifying aspects of privacy policies. Our approach relies on information-flow control. Concretely, we use the programming language Jif, an extension of Java with information-flow types. We address basic leaks of private information and also consider other aspects of privacy policies supported by the Platform for Privacy Preferences (P3P) an...
متن کاملAn information-leak analysis system based on program slicing
For programs using secret information such as credit card numbers, preventing information leaks is important. Denning, for example, has proposed a mechanism to certify that a given program does not violate a security policy. Kuninobu, on the other hand, has proposed a more practical framework for calculating the secrecy level of each output value from the secrecy level set to each input value, ...
متن کامل