A Typestate Approach to Purpose-aware Programming

2026-06-24

AI Summary

Existing systems lack mechanisms to effectively verify at compile time whether sensitive data is used in accordance with its intended purposes. This work proposes a typestate-based approach that models the typestate of sensitive data as the set of its permitted uses and supports dynamic adjustments under runtime changes in data usage, thereby enabling static enforcement of purpose compliance. As the first effort to apply typestate to data purpose verification, we design and implement PurPL, an object-oriented language featuring a purpose-aware type system that provides strong compile-time guarantees. Experimental evaluation demonstrates that our approach is both effective and practical across a range of sensitive data processing scenarios.

Abstract

Real-world applications often require verification that sensitive data is being used for their intended purpose. However, existing literature offers limited results regarding compile-time guarantees in this domain. In this paper, we explore the use of typestate to reason about the purpose of data. In typestate, types have a state, which can transition to other states in the style of automata. In our approach, the state of the type of sensitive data is defined as the set of purposes for which the data can be used. This set can grow or shrink at runtime as purposes can be added or removed during execution. In this paper, we have developed PurPL, an object-oriented programming language that features a typestate system that is capable of reasoning about purposes and data usage compliance according to them. We give an overview of PurPL through examples and present a formal type system. We have also implemented PurPL's type checker, and we report on our experiments with type checking various programming scenarios that handle sensitive data.

Problem

• purpose-aware programming
• typestate
• sensitive data
• compile-time verification
• data usage compliance

Innovation

• typestate
• purpose-aware programming
• data usage compliance
• sensitive data
• static verification