Jeeves – A Language for Automatically Enforcing Privacy Policies

It's my understanding that large companies will create proprietary frameworks that help manage privacy policies on data. Programmers will typically be required to follow certain coding discipline when working with sensitive values so that they're calling library functions to manage policies. To my knowledge, however, these libraries deal with access control (who can access a specific piece of information) rather than information flow (how information may flow through a system).

Now here's the difference between access control and information flow--and why we need a language (or at least a DSL). When you only have access control, you're trusting the programmer to tell you correctly at one point where a piece of data is going. Even if a sensitive location value is used in a bunch of search queries, the result of which is shared as a status (that becomes visible to many people with different levels of access), the programmer is responsible for asking for the right level of access when accessing that location. With the complex policies we're starting to see in modern applications, managing this is becoming increasingly burdensome for developers. That's why were looking at how to automatically handle information flow: the system tracks how sensitive values are used in order to make sure the values--and resulting computations--are flowing only to those with appropriate permissions. While it's relatively simple to hook access control into existing programming models, automatically handling information flow requires enhancing the language semantics (especially for conditions and function calls) to track additional information.

Automatically managing information flow the way Jeeves does significantly relieves programmer burden, but can be computationally expensive. Much of our research these days is about how to make this more efficient so that companies can one day put this sort of mechanism into their production systems.

Happy to answer additional questions!

"When you only have access control, you're trusting the programmer to tell you correctly at one point where a piece of data is going."

Right, that pretty much sums it all up, and I have my suspicions (independent of your response) that something like Jeeves could add value even to a "state of the art" company like Facebook :)

I'll be watching your project with great interest and may even follow up with you "offline" once I dig in some more, because I think you're really onto something of great importance. Any sufficiently complex enterprise system eventually needs something not too different from what you're working on here...