RuleKeeper: GDPR-Aware Personal Data Compliance for Web Frameworks

2023 IEEE Symposium on Security and Privacy (SP) Pub Date : 2023-05-01 DOI:10.1109/SP46215.2023.10179395

Mafalda Ferreira, Tiago Brito, J. Santos, Nuno Santos

{"title":"RuleKeeper: GDPR-Aware Personal Data Compliance for Web Frameworks","authors":"Mafalda Ferreira, Tiago Brito, J. Santos, Nuno Santos","doi":"10.1109/SP46215.2023.10179395","DOIUrl":null,"url":null,"abstract":"Pressured by existing regulations such as the EU GDPR, online services must advertise a personal data protection policy declaring the types and purposes of collected personal data, which must then be strictly enforced as per the consent decisions made by the users. However, due to the lack of system-level support, obtaining strong guarantees of policy enforcement is hard, leaving the door open for software bugs and vulnerabilities to cause GDPR-compliance violations.We present RuleKeeper, a GDPR-aware personal data policy compliance system for web development frameworks. Currently ported for the MERN framework, RuleKeeper allows web developers to specify a GDPR manifest from which the data protection policy of the web application is automatically generated and is transparently enforced through static code analysis and runtime access control mechanisms. GDPR compliance is checked in a cross-cutting manner requiring few changes to the application code. We used our prototype implementation to evaluate RuleKeeper with four real-world applications. Our system can model realistic GDPR data protection requirements, adds modest performance overheads to the web application, and can detect GDPR violation bugs.","PeriodicalId":439989,"journal":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","volume":"127 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"1","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2023 IEEE Symposium on Security and Privacy (SP)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/SP46215.2023.10179395","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 1

Abstract

Pressured by existing regulations such as the EU GDPR, online services must advertise a personal data protection policy declaring the types and purposes of collected personal data, which must then be strictly enforced as per the consent decisions made by the users. However, due to the lack of system-level support, obtaining strong guarantees of policy enforcement is hard, leaving the door open for software bugs and vulnerabilities to cause GDPR-compliance violations.We present RuleKeeper, a GDPR-aware personal data policy compliance system for web development frameworks. Currently ported for the MERN framework, RuleKeeper allows web developers to specify a GDPR manifest from which the data protection policy of the web application is automatically generated and is transparently enforced through static code analysis and runtime access control mechanisms. GDPR compliance is checked in a cross-cutting manner requiring few changes to the application code. We used our prototype implementation to evaluate RuleKeeper with four real-world applications. Our system can model realistic GDPR data protection requirements, adds modest performance overheads to the web application, and can detect GDPR violation bugs.

查看原文本刊更多论文

RuleKeeper: Web框架的gdpr意识个人数据合规性

在欧盟GDPR等现有法规的压力下，在线服务必须宣传个人数据保护政策，声明收集个人数据的类型和目的，然后必须根据用户做出的同意决定严格执行。然而，由于缺乏系统级的支持，很难获得政策执行的有力保证，这就为软件漏洞和漏洞造成违反gdpr合规的行为敞开了大门。我们提出了RuleKeeper，一个基于gdpr的个人数据政策合规系统，用于web开发框架。目前为MERN框架移植，RuleKeeper允许web开发人员指定一个GDPR清单，从该清单中自动生成web应用程序的数据保护策略，并通过静态代码分析和运行时访问控制机制透明地执行。以横切方式检查GDPR合规性，只需对应用程序代码进行少量更改。我们使用原型实现用四个实际应用程序来评估RuleKeeper。我们的系统可以模拟现实的GDPR数据保护要求，为web应用程序增加适度的性能开销，并可以检测GDPR违规错误。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2023 IEEE Symposium on Security and Privacy (SP)

自引率

0.00%

发文量