User-Controlled Privacy: Taint, Track, and Contro

No ratings

Presented at Privacy Enhancing Technologies Symposium 2024 by

François Hublet

David Basin

Srđan Krstić

We develop the first language-based, Privacy by Design approach that provides support for a rich class of privacy policies. The policies are user-defined, rather than programmer-defined, and support fine-grained information flow restrictions (considering individual application inputs and outputs) with temporal constraints. Our approach, called Taint, Track, and Control (TTC), combines dynamic information-flow control and runtime verification to enforce these policies in the presence of malicious users and developers. We provide TTC’s semantics and proofs of correct enforcement, formalized in the Isabelle/HOL proof assistant. We also implement our approach in a web development framework and port three baseline applications from previous work into this framework for evaluation. Overall, we find that our approach enforces expressive user-defined privacy policies with practical runtime performance