A Framework for Automatically Enforcing Privacy Policies

Add to your list(s) Download to your calendar using vCal

• Jean Yang, MIT
• Tuesday 15 October 2013, 11:00-12:00
• Auditorium, Microsoft Research Ltd, 21 Station Road, Cambridge, CB1 2FB.

If you have a question about this talk, please contact Microsoft Research Cambridge Talks Admins.

This event may be recorded and made available internally or externally via http://research.microsoft.com. Microsoft will own the copyright of any recordings made. If you do not wish to have your image/voice recorded please consider this before attending

It is increasingly important for applications to protect sensitive data. Security policies are difficult to manage because their global nature requires coordinated reasoning and enforcement. To mitigate this, we propose a policy-agnostic programming model in which the programmer implements information flow policies separately from the other functionality. The programmer may rely on the runtime to automatically produce outputs adhering to these policies. For my Ph.D. thesis, I have developed the Jeeves programming language to explore this model. Jeeves allows programmers to define multiple views of sensitive values along with policies for disclosing these views. The Jeeves semantics describe the dynamic enforcement of these policies. We have proven security guarantees about our semantics and implemented Jeeves as an embedded domain-specific language in Scala. We have used our implementation to build a small conference management system. The goal of my thesis is to demonstrate the feasibility of policy-agnostic programming in a web framework. Towards this, we are working on a Python implementation of Jeeves and also working on extending Jeeves’s guarantees across the database interface.

This talk is part of the Microsoft Research Cambridge, public talks series.

This talk is included in these lists:

• All Talks (aka the CURE list)
• Auditorium, Microsoft Research Ltd, 21 Station Road, Cambridge, CB1 2FB
• Cambridge Centre for Data-Driven Discovery (C2D3)
• Cambridge talks
• Chris Davis' list
• Guy Emerson's list
• Interested Talks
• Microsoft Research Cambridge, public talks
• Optics for the Cloud
• PMRFPS's
• School of Technology
• Trust & Technology Initiative - interesting events
• bld31
• ndk22's list
• ob366-ai4er
• personal list
• rp587

Note that ex-directory lists are not shown.