A Framework for Automatically Enforcing Privacy Policies Jean Yang MSRC / October 15, 2013

Privacy matters. People get it wrong.

Many possible points of failure. getLocation(user) findAllUsers(location) findTopLocations() Only friends can see GPS location. Desired Policy Policy Implementation Policy

Increasingly complex policies. Only friends can see GPS location. Desired Policy who are local within next five hours

Jean Yang / Jeeves5

Easier if we separate policies from other functionality. getLocation(user) findAllUsers(location) findTopLocations() Only friends can see GPS location. Policy ImplementationOther Implementation

Jean Yang / Jeeves7

 |  findAllUsers(MSRC) The Jeeves Language k You have no friends in this location. Jean Yang / Jeeves8 Associated with policies.

val loc =  gpsCoords | country(gpsCoords)  a label a Core Functionality val msg = “Jean’s location is ” + asStr(loc) Contextual Enforcement print {andrey} msg “Jean’s location is N , W 0.13 .” print {rishabh} msg “Jean’s location is in the United Kingdom.” Policies restrict a: oc.(isNear(oc, jean)) { low, high } 9 Sensitive Values Jean Yang / Jeeves Label. Output channel. Predicate. High value.Low value.

Jeeves Execution = 3 Faceted execution 10Jean Yang / Jeeves  3 | 0  a  true | false  a Storing policies Policies label a restrict a: oc.true Constraints print {…} … true  a = low a  oc.true false

Jean Yang / Jeeves11 restrict a: oc.isNear(oc,me) Policies may refer to sensitive values. Jeeves Policies oc.addConstraint(  isNear(oc, me)  a == low) Constraints always take this form. Notes There is always a consistent assignment. Notion of maximal functionality: if a label is allowed to be high, we try to set it to high.

Jean Yang / Jeeves12

Jean Yang / Jeeves13 Classical Security Level 3: top secret. Level 2: highly classified. Level 1: privileged information. Lattice of access levels.

Jean Yang / Jeeves14 Classical Security Viewers must have access for the highest level. + Level 3 Level 0

 |  Jean Yang / Jeeves15 Jeeves Security p +

Jeeves Non-Interference Guarantee  H | L  a Given a sensitive value all executions where a must be low produce equivalent outputs no matter the value of H. 16Jean Yang / Jeeves Takes into account when label depends on sensitive values!

Non-Interference in Jeeves 17Jean Yang / Jeeves restrict a: oc.(distance(oc, location) < 25) protected location viewer Viewer within radius: a is allowed to be high.

Non-Interference in Jeeves 18Jean Yang / Jeeves restrict a: oc.(distance(oc, location) < 25) protected location Viewer outside radius: a must be low. Viewer should not be able to distinguish actual location from any other of these points. viewer

Jean Yang / Jeeves19

Implementation Overload operators for faceted evaluation. Policy environment Use an SMT solver as a model finder. print mkLabel restrict 20Jean Yang / Jeeves = 3  3 | 42  a Store policies in runtime environment  true | false  a false

Case study: JConf Jean Yang / Jeeves21 JConf policies JConf functionality ReviewerAuthor

User Role Paper Title Author Reviews Tags … Policy Review Reviewer Content Policy Context User Stage Policy Core Program Search papers. Display papers. Add and remove tags. Assign and submit reviews. Functionality 22Jean Yang / Jeeves Jconf Architecture

Functionality vs. Policy FileTotal LOCPolicy LOC ConfUser.scala21221 PaperRecord.scala30475 PaperReview.scala11632 ConfContext.scala60 Backend + Squeryl8000 Frontend (Scalatra)6290 Frontend (SSP)7980 Total Jean Yang / Jeeves < 5%

Jean Yang / Jeeves24 SQL (Squeryl) Embedded DSL Scalatra frontend PostGre SQL Embedded DSL Django frontend Jeeves Frameworks Python-Jeeves source transform

Jean Yang / Jeeves25 What about inputs? Reviewer A Reviews New review Reviewer B New review --- Author

Jean Yang / Jeeves26 Reviewer A Reviews New review Reviewer B New review Old review Author Storing multiple versions?

Jean Yang / Jeeves27 Scores New score Old score User --- User When viewers specify trust… Need to additionally track who is writing…

Low-level mechanism Jean Yang / Jeeves28 Mutable State 42 p1p1 p2p2 p2p2 Associate references with policies wrestrict in. out. ((in == alice) && isFriends (out, alice)) wrestrict in. out.(isFriends(in, alice))

Jean Yang / Jeeves29 Execution with writer’s inputs Execution without writer’s inputs New score Guarantees

Write Policy Case Studies Jean Yang / Jeeves30 AuthenticationBattleship game Conference management Notes Support policies for confidentiality and integrity. Policy-agnosticism good for encoding other policies, for instance game rules.

 |  Jean Yang / Jeeves31 select * from papers where author = “Jean Yang” author high author low policies p Interfacing with the DB

32 FINALLY.. I CAN FOCUS ON FUNCTIONALITY!

Jeeves Team Jean Yang / Jeeves33 Armando Solar- Lezama Thomas Austin Cormac Flanagan Travis Hance Benjamin Shaibu

 |  Program The Jeeves Framework k Jean Yang / Jeeves34 Customized page jeeveslang.org