Controlling Data Flow with a Policy-Based Programming Language for the Web Thierry Sans Iliano Cervesato Soha Hussein
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective 85GA7
Privacy from the user’s perspective Should I use this app? How does this app use my data? 85GA7
Privacy from the user’s perspective Should I use this app? How does this app use my data? 85GA7
Privacy from the user’s perspective Should I use this app? How does this app use my data? App’s Privacy Policy 85GA7
Privacy from the user’s perspective Should I use this app? How does this app use my data? User’s Privacy App’s Privacy Policy Expectations 85GA7
Privacy from the user’s perspective Should I use this app? How does this app use my data? User’s Privacy App’s Privacy Policy Expectations 85GA7
Privacy from the web developer’s perspective
Privacy from the web developer’s perspective How to write my privacy policy?
Privacy from the web developer’s perspective How to write my privacy policy?
Can we generate a privacy policy automatically?
Can we generate a privacy policy automatically? Based on the privacy policies of third party service providers ...
Can we generate a privacy policy automatically? Based on the privacy policies of … and based on how the program third party service providers ... combines these services ...
Can we generate a privacy policy automatically? Based on the privacy policies of … and based on how the program third party service providers ... combines these services ... … can we infer how user’s data will be used? *
Can we generate a privacy policy automatically? Based on the privacy policies of … and based on how the program third party service providers ... combines these services ... … can we infer how user’s data will be used? * * no adversary model, third parties are trustworthy
Two solutions
Two solutions Solution 1 : Analyze the programs and infer the data flow ➡ Static analysis, abstract interpretation
Two solutions Solution 1 : Analyze the programs and infer the data flow ➡ Static analysis, abstract interpretation Solution 2 : Design a new programming language ➡ Qwel (Qatar Web Programming Language) with data flow
Qwel : lambda calculus + primitives for remote procedure call + . . . Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ → τ ’ | τ ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2
Qwel : lambda calculus + primitives for remote procedure call + . . . Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ → τ ’ | τ ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Typing Σ | Γ ⊢ w e : τ “e has type τ at w w.r.t. Σ and Γ ” Γ ::= · | Γ , x : τ Σ ::= · | Σ , w/u : τ ⇒ τ
Programming with Qwel
Programming with Qwel @w 1 publish x : τ . e
Programming with Qwel @w 1 w 1 / u 1 publish x : τ . e
Programming with Qwel @w 0 @w 1 w 1 / u 1 call w1/u1 with input publish x : τ . e
Programming with Qwel @w 0 @w 1 input w 1 / u 1 call w1/u1 with input publish x : τ . e
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 Services Data Flow
publish x : unit. let x ʹ″ = call w 2 /u 2 with x in call w 3 /u 3 with x ʹ″ w 0 / u 0 end w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 Services Data Flow
publish x : unit. let x ʹ″ = call w 2 /u 2 with x in call w 3 /u 3 with x ʹ″ w 0 / u 0 end w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 Services Data Flow publish x : unit let x ʹ″ = call w 1 /u 1 with x x ʹ″ʹ″ = call w 4 /u 4 with x ʹ″ x ʹ″ʹ″ʹ″ = call w 5 /u 5 with x ʹ″ in ⟨ x ʹ″ʹ″ , x ʹ″ʹ″ʹ″ ⟩ end
λ input:unit.(call w 0 /u 0 with input) publish x : unit. let x ʹ″ = call w 2 /u 2 with x in call w 3 /u 3 with x ʹ″ w 0 / u 0 end w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 Services Data Flow publish x : unit let x ʹ″ = call w 1 /u 1 with x x ʹ″ʹ″ = call w 4 /u 4 with x ʹ″ x ʹ″ʹ″ʹ″ = call w 5 /u 5 with x ʹ″ in ⟨ x ʹ″ʹ″ , x ʹ″ʹ″ʹ″ ⟩ end
λ input:unit.(call w 0 /u 0 with input) w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
Where is input going to? λ input:unit.(call w 0 /u 0 with input) How will it be used? w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
Where is input going to? λ input:unit.(call w 0 /u 0 with input) How will it be used? w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
Where is input going to? λ input:unit.(call w 0 /u 0 with input) How will it be used? w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 Can we get a symbolic expression that represents how input is used? ➡ The data flow of input
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 no flow
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 service flow
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
sequential flow w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5
w 0 / u 0 w 1 / u 1 w 2 / u 2 w 3 / u 3 w 4 / u 4 w 5 / u 5 parallel flow
Qwel with Flow Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ { μ } → τ ’ | τ { μ } ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Flow μ :: = • | w ≻ μ | μ ; μ ʹ″ | μ ∥ μ ʹ″
Qwel with Flow Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ { μ } → τ ’ | τ { μ } ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Flow μ :: = • | w ≻ μ | μ ; μ ʹ″ | μ ∥ μ ʹ″ no
Qwel with Flow Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ { μ } → τ ’ | τ { μ } ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Flow μ :: = • | w ≻ μ | μ ; μ ʹ″ | μ ∥ μ ʹ″ service no
Qwel with Flow Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ { μ } → τ ’ | τ { μ } ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Flow μ :: = • | w ≻ μ | μ ; μ ʹ″ | μ ∥ μ ʹ″ composition service no
Qwel with Flow Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ { μ } → τ ’ | τ { μ } ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Flow μ :: = • | w ≻ μ | μ ; μ ʹ″ | μ ∥ μ ʹ″ parallel composition service no
Qwel with Flow Fragment of the language syntax Types τ :: = unit | τ × τ ʹ″ | τ { μ } → τ ’ | τ { μ } ⇒ τ ’ Expressions e :: = x | λ x: τ .e | (e 1 e 2 ) | ⟨ e 1 ,e 2 ⟩ | fst e | snd e | () | w/u | publish x: τ .e | call e 1 with e 2 Flow μ :: = • | w ≻ μ | μ ; μ ʹ″ | μ ∥ μ ʹ″ parallel composition service no Typing Σ | Γ ⊢ w e : τ “e has type τ at w w.r.t. Σ and Γ ” Γ ::= · | Γ , x : τ { μ } Σ ::= · | Σ , w/u : τ { μ } ⇒ τ
No Flow and Service flow publish x : unit. call w 2 /u 2 with x w 0 / u 0 w 1 / u 1 w 2/ u 2 publish x : unit. x publish x : unit. call w 1 /u 1 with x
No Flow and Service flow publish x : unit. call w 2 /u 2 with x w 0 / u 0 w 1 / u 1 w 2/ u 2 : unit {w 2 ≻ •} ⇒ unit publish x : unit. x publish x : unit. call w 1 /u 1 with x
No Flow and Service flow publish x : unit. call w 2 /u 2 with x w 0 / u 0 w 1 / u 1 w 2/ u 2 : unit {w 2 ≻ •} ⇒ unit publish x : unit. x : unit {w 0 ≻ (w 1 ≻ (w 2 ≻ •))} ⇒ unit publish x : unit. call w 1 /u 1 with x
No Flow and Service flow : unit {w 1 ≻ (w 2 ≻ •)} ⇒ unit publish x : unit. call w 2 /u 2 with x w 0 / u 0 w 1 / u 1 w 2/ u 2 : unit {w 2 ≻ •} ⇒ unit publish x : unit. x : unit {w 0 ≻ (w 1 ≻ (w 2 ≻ •))} ⇒ unit publish x : unit. call w 1 /u 1 with x
Recommend
More recommend
