Harpocrates: A Statically Typed Privacy Conscious Programming Framework

2024-11-10

arXiv.org

AI Summary

To address the challenges of delayed privacy policy binding, fragmented enforcement, and invasive updates in programming frameworks, this paper proposes a statically typed privacy-aware programming framework for Scala. Our method introduces the “oblivious membranes” paradigm: privacy policies are statically embedded into data types at creation time via the type system, preventing raw sensitive data from ever being exposed; policy checks are declaratively centralized at system boundaries and dynamically triggered only upon data access or cross-domain transfer—eliminating reliance on traditional information-flow analysis. Implemented via compiler plugins, type-system extensions, and runtime interception, the framework enables zero-intrusion policy upgrades: when multiple applications share data, updating the dependency version suffices—no downstream code modification is required. The approach ensures formally verifiable, maintainable privacy logic, effectively balancing strong security guarantees with practical engineering usability.

Technology Category

• Machine Learning: Privacy
• Data Mining & Knowledge Management: Scalability, Parallel & Distributed Systems
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy

Application Category

• Security and Privacy: Privacy-enhancing technologies
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

In this paper, we introduce Harpocrates, a compiler plugin and a framework pair for Scala that binds the privacy policies to the data during data creation in form of oblivious membranes. Harpocrates eliminates raw data for a policy protected type from the application, ensuring it can only exist in protected form and centralizes the policy checking to the policy declaration site, making the privacy logic easy to maintain and verify. Instead of approaching privacy from an information flow verification perspective, Harpocrates allow the data to flow freely throughout the application, inside the policy membranes but enforces the policies when the data is tried to be accessed, mutated, declassified or passed through the application boundary. The centralization of the policies allow the maintainers to change the enforced logic simply by updating a single function while keeping the rest of the application oblivious to the change. Especially in a setting where the data definition is shared by multiple applications, the publisher can update the policies without requiring the dependent applications to make any changes beyond updating the dependency version.

Problem

• Enforcing privacy policies during data creation and access
• Centralizing policy checks for easier maintenance and verification
• Allowing data flow while protecting at access and mutation points

Innovation

• Compiler plugin for Scala with oblivious membranes
• Centralizes policy checking at declaration site
• Enforces policies upon data access or mutation