  Conventional Data Leakage Prevention (DLP) systems suffer from the following
major drawback: Privacy policies that define what constitutes data leakage
cannot be seamlessly defined and enforced across heterogeneous forms of
communication. Administrators have the dual burden of: (1) manually
self-interpreting policies from handbooks to specify rules (which is
error-prone); (2) extracting relevant information flows from heterogeneous
communication protocols and enforcing policies to determine which flows should
be admissible. To address these issues, we present the Verifiable and
ACtionable Contextual Integrity Norms Engine (VACCINE), a framework for
building adaptable and modular DLP systems. VACCINE relies on (1) the theory of
contextual integrity to provide an abstraction layer suitable for specifying
reusable protocol-agnostic leakage prevention rules and (2) programming
language techniques to check these rules against correctness properties and to
enforce them faithfully within a DLP system implementation. We applied VACCINE
to the Family Educational Rights and Privacy Act and Enron Corporation privacy
regulations. We show that by using contextual integrity in conjunction with
verification techniques, we can effectively create reusable privacy rules with
specific correctness guarantees, and check the integrity of information flows
against these rules. Our experiments in emulated enterprise settings indicate
that VACCINE improves over current DLP system design approaches and can be
deployed in enterprises involving tens of thousands of actors.
