Usable Privacy-Aware Logging for Unstructured Log Entries

Log files are a basic building block of computer systems. They typically contain sensitive data, for example, information about the internal structure of a service and its users. Additionally, log records are usually unstructured in the sense that sensitive data will not occur in every entry and not always occur at defined positions within a record. To mitigate the threat of illicit access to log files, we propose a flexible framework for the creation of privacy-preserving log records. A crucial step is the annotation of sensitive data, by using arbitrary labels, during the development of a system. These labels are mapped to redaction filters to form a redaction policy. Thus, we can create two parallel log streams. One log stream contains fully redacted log entries. It, hence, does not contain any sensitive information and is intended for everyday use. The second stream contains the original entires. Here, confidentiality must be ensured. Our framework fosters privacy by default principles and can support selective disclosure of relevant data. We developed an implementation of our solution for logback, one of the major logging frameworks in Java, and successfully evaluated its applicability.