Harpocrates: A Statically Typed Privacy Conscious Programming Framework
This paper introduces Harpocrates, a statically typed Scala framework that enforces privacy policies by wrapping data in oblivious membranes at creation, thereby eliminating raw data from the application and centralizing policy enforcement to allow for seamless, dependency-version-based updates without requiring changes to dependent applications.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are running a busy, high-security bank. You have a vault full of customer data (names, addresses, bank balances). In a normal bank, anyone who walks in with a key can open any drawer, grab a file, and walk out. If a tellor makes a mistake or gets distracted, sensitive data might leak out the front door.
Harpocrates is like a revolutionary new security system for software that changes the rules of the game. Instead of hoping the bank tellors remember to check IDs every time, Harpocrates turns every single piece of data into a smart, self-locking box the moment it is created.
Here is how it works, broken down into simple concepts:
1. The "Smart Box" (Oblivious Membranes)
In traditional programming, data is like a piece of paper. You can write on it, copy it, or hand it to anyone. If you forget to put it in a safe, it's vulnerable.
Harpocrates wraps every piece of sensitive data in a Smart Box (called a "membrane").
- The Magic: You don't even know the box is there. To the programmer, the data looks and feels exactly like a normal piece of paper. They can write code, do math, and pass it around just like they always have.
- The Catch: The box is "oblivious." It doesn't stop the data from moving inside the building. It only stops the data from leaving the building or being read by the wrong person.
- The Lock: The box has a built-in security guard. If someone tries to open the box to take the data out of the bank (send it over the internet, save it to a public log, or show it to an unauthorized person), the guard asks: "Do you have permission?"
2. The "Rulebook" (Centralized Policies)
In many big companies, security rules are written in different places. One team writes a rule for emails, another for addresses, and a third for phone numbers. If the law changes (like GDPR), someone has to find every single rule and update it. It's a nightmare, and mistakes happen.
Harpocrates uses a Centralized Rulebook.
- There is one master list of rules (a "Policy Class").
- When you create a Smart Box, you attach this Rulebook to it.
- The Superpower: If the rules change, you only update the Rulebook in one place. Every single Smart Box in the entire application instantly updates its security logic. The developers who wrote the code don't need to change a single line of their logic; the boxes just start following the new rules automatically.
3. The "Bouncer" at the Door (Declassification)
The Smart Boxes can travel freely inside the application. They can be added to lists, sorted, or processed. This is great because it doesn't slow down the work.
However, the moment the data tries to leave the application (like sending an email to a customer or saving to a database), it hits the "Bouncer."
- The Bouncer checks the Rulebook.
- Scenario A: "Is this publication allowed to see this band's email?" The Bouncer checks the list. If the publication unsubscribed, the Bouncer says, "Nope, stay inside," and blocks the data.
- Scenario B: "Is the band owner looking at their own email?" The Bouncer checks the context, sees it's the owner, and says, "Go ahead."
4. Why is this better than the old way?
The paper compares Harpocrates to two other methods:
- The "Monadic" Way (The Backpack): Imagine forcing every programmer to carry a heavy backpack (a "Monad") that holds their data. They have to manually put the data in the backpack and take it out every time they use it. If they forget, the data is exposed. It's tedious and easy to mess up.
- The "Static" Way (The ID Card): Imagine giving every piece of data a permanent ID card that says "Top Secret." This works well if the rules never change. But if the rules are dynamic (e.g., "Check the database to see if this person unsubscribed"), static cards fail because they can't check the database in real-time.
Harpocrates is the best of both worlds:
- It's invisible to the programmer (no heavy backpacks).
- It's dynamic (the Bouncer checks the live database in real-time).
- It's centralized (one update fixes the whole system).
The Real-World Test: "Vizion"
The authors tested this on a real app called Vizion, which helps musicians manage their careers. Musicians send press releases to magazines. Sometimes, a magazine wants to unsubscribe from a specific band.
- Without Harpocrates: A developer has to remember to add an
ifstatement in the email code to check if the magazine unsubscribed. If they forget, the magazine gets an email they didn't want, and the band might get sued. - With Harpocrates: The email address is put in a Smart Box. When the "Send Email" button is clicked, the Bouncer automatically checks the unsubscribe list. If the magazine is on the list, the email is blocked. The developer didn't have to write the check; the system did it automatically.
The Cost
Is there a price to pay?
- Speed: It's slightly slower (about 8-12% slower) because the Bouncer has to do a check every time data leaves the building. But the authors argue this is a small price to pay to prevent massive data leaks and lawsuits.
- Effort: It took very little effort to add this to the existing app (only about 60 lines of code added).
The Bottom Line
Harpocrates is like installing smart locks on every door in a building. You don't have to tell the employees to lock the doors; the doors lock themselves automatically based on who is trying to walk through. It makes privacy "baked in" rather than "bolted on," ensuring that even if a human makes a mistake, the data stays safe.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.