Language-based Approaches for Enforcing Privacy and Security Policies

Abstract

Nowadays, compliance with the General Data Protection Regulation (GDPR) poses a significant challenge for enterprises processing personal data. The GDPR protects individuals' privacy and imposes strict requirements on the processing of such data. Failure to comply with the GDPR can result in fines of up to 20 million Euros or even 4% of the company's total annual turnover. In this thesis, Farzane Karami has focused on exploring methods to enforce the GDPR requirements at the level of a programming language. Karami’s approach involves designing an object-oriented programming language that enforces the GDPR's data usage requirements during program execution. The contributions of this thesis can be categorized as follows: 1) Designing a data protection language (called DPL) with the necessary language features to enforce the GDPR requirements, 2) Formalizing and simulating DPL’s semantics in a logical framework, which provides an executable interpreter to experiment and verify that DPL programs cannot violate the GDPR properties 3) Providing a pen and paper proof to verify our claims. In this thesis, we also conduct research on enforcing security policies in distributed systems, where only authorized entities can access confidential data. We use the language-based approaches and formal methods to automate program analysis and verify whether a program is secure.