Making Programs Forget: Enforcing Lifetime For Sensitive Data
📜 Abstract
This paper introduces guaranteed data lifetime, a novel system property ensuring that sensitive data cannot be retrieved from a system beyond a specified time. The trivial way to achieve this is to “reboot”; however, this is disruptive from the user’s perspective, and may not even eliminate disk copies. We discuss an alternate approach based on state re-incarnation where data expiry is completely transparent to the user, and can be used even if the system is not designed a priori to provide the property.
✨ Summary
The paper introduces guaranteed data lifetime, the property that sensitive data supplied to an application should become irretrievable from the local system after a specified lifetime. It targets legacy applications that may retain data in application memory, operating-system buffers, caches, files, swap, or other components without explicit support for secure expiration.
The proposed mechanism, called state re-incarnation, checkpoints an application before sensitive input is delivered, logs subsequent inputs and nondeterministic results, and restores the checkpoint when the data expires. The system then replays the logged execution while replacing the sensitive input with a non-sensitive substitute. The resulting application state is intended to preserve non-sensitive user-visible effects while eliminating state derived from the expired data. The paper considers omission, ordinary substitution, and consistent substitution; consistent substitution uses symbolic execution and constraint solving to preserve the original control flow as closely as possible.
The main technical challenges are fidelity, pervasive coverage of all data-retention locations, containment of information shared with other processes or remote systems, and performance. The authors identify a fundamental tension between secrecy and fidelity: a substitute that preserves more application behavior may necessarily reveal properties such as the sensitive input’s length or control-flow constraints. The paper therefore proposes leakage thresholds and application shutdown as a fallback when acceptable fidelity cannot be achieved.
The work presents a preliminary Valgrind-based logging experiment using Bash. Of 33,481 executed instructions, 266 processed tainted input, generating 9,730 constraints. The authors estimate that continuous logging could incur approximately 3× overhead in representative client-side settings, while replay could run on a shadow application image. The paper is primarily a design proposal; it does not report a complete, general-purpose implementation or demonstrate that the proposed guarantees hold across arbitrary applications and system components. (usenix.org)
Subsequent research cited the paper as an approach based on snapshotting, rollback, and replay for removing private state. Eternal Sunshine of the Spotless Machine: Protecting Privacy with Ephemeral Channels pursued a different, hypervisor-based design for forensic deniability, motivated by persistent traces in operating-system and peripheral buffers. Gone, But Not Forgotten: The Current State of Private Computing explicitly contrasts the paper’s replay-based approach with its proposed system-level private-computing service, noting the replay method’s implementation complexity and overhead. These works indicate that the paper helped frame data lifetime and post-use trace removal as system-wide privacy problems, while later designs explored stronger isolation and more pervasive erasure mechanisms. (cs.utexas.edu)