Practical Privacy via New Systems and Abstractions
Kinan Dak Albab
Brown University
CIS@MPG Colloquium
hosted by: Peter Schwabe
Kinan Dak Albab is a PhD candidate at Brown University, advised by Malte Schwarzkopf. He is interested in building real systems and practical tools to improve privacy in the real-world using techniques from computer systems, cryptography, and programming languages. His software has been used in the real world to perform privacy-preserving analytics for the social good, and validate the next generation of SDN network switches at Google.
Data privacy has become a focal point for public discourse. In response, Data protection and privacy regulations have been enacted across the world, including the GDPR and CCPA, and companies make various promises to end-users in their privacy policies. However, high profile privacy violations remain commonplace, in part because complying with privacy regulations and policies is challenging for applications and developers. This talk demonstrates how we can help developers achieve privacy compliance by designing new privacy-conscious systems and abstractions. This talk focuses on my work on Sesame (SOSP24), my system for end-to-end compliance with privacy policies in web applications. To provide practical guarantees, Sesame combines new static analysis for data leakage with advances in memory safe languages and lightweight sandboxing, as well as standard industry practices like code review. My work in this area also includes K9db (OSDI23), a privacy-compliant database that supports compliance-by-construction with GDPR-style subject access requests. By creating privacy abstractions at the systems level, we can offer applications privacy guarantees by design, in order to simplify compliance and improve end-user privacy.