@conference {614185,
	title = {Riverbed: Enforcing User-defined Privacy Constraints in Distributed Web Services},
	booktitle = {NSDI},
	year = {2019},
	address = {Boston, MA},
	abstract = {Riverbed is a new framework for building privacy-respecting web services. Using a simple policy language, users define restrictions on how a remote service can process and store sensitive data. A transparent \&nbsp;Riverbed proxy sits between a user{\textquoteright}s front-end client (e.g., a web browser) and the back-end server code. The back-end code remotely attests to the proxy, demonstrating that the code respects user policies; in particular, the server code attests that it executes within a \&nbsp;Riverbed-compatible managed runtime that uses IFC to enforce user policies. If attestation succeeds, the proxy releases the user{\textquoteright}s data, tagging it with the user-defined policies. On the server-side, the \&nbsp;Riverbed runtime places all data with compatible policies into the same universe (i.e., the same isolated instance of the full web service). The universe mechanism allows \&nbsp;Riverbed to work with unmodified, legacy software; unlike prior IFC systems, \&nbsp;Riverbed does not require developers to reason about security lattices, or manually annotate code with labels. \&nbsp;Riverbed imposes only modest performance overheads, with worst-case slowdowns of 10\% for several real applications.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/riverbed.pdf},
	author = {Frank Wang and Ronny Ko and James Mickens}
}
