Method for generating at least one error-triggering input for detecting errors in a software program

Abstract

The invention relates to a method (100) for generating at least one error-triggering input for detecting errors in a software program (1), having the steps of: - providing (101) an input which leads to an error during an execution of the software program (1), - determining (102) individual logical conditions within the software program (1) which are met if the error occurs during the execution of the software program (1), - providing (103) an additional logical condition according to which an inequality is required between a generated input and the provided input, - generating (104) at least one input which satisfies the determined individual logical conditions and the provided additional logical condition, - checking (105) whether the at least one generated input leads to the error during the execution of the software program (1), and - providing (106) the at least one checked input as the at least one error-triggering input for detecting errors in the software program (1) if the input leads to the error during the execution of the software program (1). The invention also relates to a computer program, to a device, and to a storage medium for this purpose.

Description

[0001] R.416140

[0002] - 1 -

[0003] Description

[0004] title

[0005] Method for generating at least one error-triggering input for debugging in a software program

[0006] The invention relates to a method for generating at least one error-triggering input for error detection in a software program. The invention further relates to a computer program, a device, and a storage medium for this purpose.

[0007] State of the art

[0008] Trusted Execution Environments (TEEs) are environments secured by confidential computing techniques, such as Intel SGX Enclaves or Intel TDX Trust Domains. Software programs that process sensitive or private data can be run in production mode within TEEs to ensure data protection and privacy. Software programs are developed by humans or, nowadays, by generative AI, both of which make mistakes and therefore introduce bugs. However, finding all the bugs in a software program is still an open research problem. Consequently, faulty software programs end up in production environments. In production, a bug can manifest itself—the software program crashes or produces incorrect output. The input that caused the bug is crucial for subsequent debugging but could allow sensitive or private data to leak from the trusted execution environment.For proper debugging of a software program with an error-causing input, an engineer needs the potentially sensitive input, to which the engineer should not have direct access in most cases. For example, the GDPR requires in Art. 5 §1 c) that sensitiveR.416140.

[0009] - 2 -

[0010] Data should be “adequate and relevant to the purpose and limited to what is necessary for the purposes of the processing”.

[0011] Concolic execution (see "Patrice Godefroid, Nils Klarlund, and Koushik Sen. 2005. DART: directed automated random testing. In Proceedings of the 2005 ACM SIGPLAN conference on Software-Programming language design and implementation (PLDI '05). Association for Computing Machinery, New York, NY, USA, 213-223. https: / / doi.org / 10.1145 / 1065010.1065036"), short for "concrete symbolic execution," is a software analysis technique that combines concrete execution (executing the software program with specific inputs) with symbolic execution (analyzing the software program paths by treating the inputs as symbolic variables). This method enables the automatic generation of test inputs that can be used to examine different execution paths within a software program in order to uncover errors or vulnerabilities.

[0012] The execution of a software program with symbolic input can be represented as a tree, where each branch represents a possible execution path determined by path constraints. The symbolic execution engine examines these paths by solving the path conditions, typically using a constraint solver or a Satisfiability Modulo Theories (SMT) solver. These solvers are powerful tools that can determine whether a set of logical constraints can be satisfied and, if so, provide a model (a set of concrete values ​​for the symbolic variables) that satisfies the conditions.

[0013] Disclosure of the invention

[0014] The invention relates to a method with the features of claim 1, a computer program with the features of claim 9, a device with the features of claim 10, and a

[0015] computer-readable storage medium having the features of claim 11.

[0016] Further features and details of the invention will become apparent from the respective R.416140.

[0017] - 3 -

[0018] The dependent claims, the description, and the drawings. Features and details described in connection with the method according to the invention naturally also apply in connection with the computer program, the device, and the computer-readable storage medium according to the invention, and vice versa, so that mutual reference is always possible with regard to the disclosure of the invention.

[0019] The invention relates in particular to a method for generating at least one error-triggering input for error detection (English:

[0020] “Debugging”) in a software program, encompassing:

[0021] Providing an input that leads to an error during the execution of the software program, orhas led to, for example, the input being entered by a user of the software program into an input mask or the like during the execution of the software program, wherein the input can be, for example, textual, visual and / or acoustic input, which can be captured via appropriate sensors and / or user interfaces during the execution of the software program, determining individual logical conditions within the software program that are fulfilled when the error occurs during the execution of the software program, wherein this step can be carried out within the framework of symbolic execution and preferably automatically, wherein each logical condition corresponds, for example, to an information technology "if" condition or the like.

[0022] Providing, defining, or formulating a further logical condition according to which an inequality of a generated, or symbolic, input with the provided input is required, wherein the further logical condition may, for example, also be provided as an "lf" condition or the like and in particular includes a comparison of the generated input with the provided input, wherein the generated input is in particular the at least one input generated in the next step of the procedure, R.416140

[0023] - 4 -

[0024] Generating at least one input that satisfies the determined individual logical conditions as well as the provided further logical condition, wherein it is conceivable that a multitude of inputs are generated and subsequently, preferably automatically, it is determined which of these generated inputs satisfy the determined individual logical conditions as well as the provided further logical condition; checking whether the at least one generated input leads to the error during the execution of the software program, for which the software program can, for example, be executed using the at least one generated input each time.

[0025] Providing at least one validated input as the at least one error-triggering input for debugging purposes in the software program if it leads to the error during the execution of the software program.

[0026] In other words, at least one validated input is provided as at least one error-triggering input so that it can subsequently be used for debugging, for example, by a developer or automatically. The software program is executed in a trusted execution environment (TEE) when the provided input leads to the error during execution of the software program. The method according to the invention thus makes it possible to generate error-triggering inputs that differ from the original provided input, thereby protecting sensitive data, for example. The method according to the invention enables, for example, efficient debugging in trusted execution environments (TEEs).

[0027] Another possibility is that the procedure may also include:

[0028] Negation of the identified individual logical conditions, wherein the negation is carried out individually for each of the identified individual logical conditions, wherein, in the course of the negation, in particular a truth value of the respective logical condition is reversed, i.e., put simply, "true" becomes "false" and R.416140

[0029] - 5 -

[0030] Conversely, negation can be performed, for example, by adding a negation operator such as “!”,

[0031] Checking whether a path of the error in the software program is still reachable after negation, whereby the check is performed individually for each of the determined individual logical conditions after negation, whereby the check can be performed, for example, on the basis of a symbolic execution or on the basis of a concrete execution of the software program.

[0032] Filtering the identified individual logical conditions depending on the respective result of the check, whereby in particular logical conditions are filtered out and no longer considered in the further course of the procedure where the path of the error in the software program is no longer reachable after negation, i.e. these logical conditions remain negated in particular.

[0033] By negating the individual logical conditions, it is possible to determine which conditions are essential for the error. Filtering the logical conditions can enable a more efficient analysis and a focus on the most relevant logical conditions.

[0034] According to a further advantage, the generation of the at least one input can be performed using a solver for combined logic problems, in particular a constraint solver, or a satisfiability modulo theories solver (SMT solver). SMT solvers are specifically based on Boolean satisfiability (SAT) solvers, which check whether a Boolean formula is satisfiable, i.e., whether there exists an assignment of variables that makes the formula true. An SMT solver is, in particular, a specialized software tool that solves logical problems described in the SMT formulation. These problems include, for example, Boolean expressions (as in SAT logic) and additional theory-specific conditions (such as arithmetic, equations, or arrays). An SMT solver takes as input, for example, a set of logical formulas in a standardized language (e.g.,The solver (SMT-LIB format) checks whether these formulas are satisfiable. For example, the solver returns one of the following results: "Satisfiable" if there is a solution that satisfies all conditions. If it is "Satisfiable", the R.416140.

[0035] - 6 -

[0036] Solvers can also return an assignment to prove that the formula is satisfiable. "Unsatisfiable" is returned if there is no solution that satisfies all conditions. "Unknown" is returned if the solver could not find an answer, for example, due to limitations in theory or runtime. Examples of SMT solvers are Z3 (from Microsoft Research), CVC4 / CVC5, Yices, and MathSAT.

[0037] It is therefore possible to employ a specialized algorithm to optimize the generated inputs. This solution algorithm can make the generation process more efficient and targeted. Furthermore, using such a solution algorithm makes it possible to find suitable input data even for more complex error scenarios.

[0038] Furthermore, within the scope of the invention, it is conceivable that the provided input includes sensitive data and that the method further comprises:

[0039] Checking the at least one generated input based on at least one criterion to determine whether the at least one generated input discloses sensitive data,

[0040] Provisioning is only carried out if a verification result indicates that at least one generated input does not disclose sensitive data. This has the particular advantage that sensitive data can be protected during troubleshooting, i.e., not disclosed, thus ensuring data privacy, for example.

[0041] According to an advantageous embodiment of the invention, it can be provided that the at least one criterion is a cardinality of the at least one generated input and / or a distance metric, for example Levenshtein distance, for evaluating a distance to the provided input.

[0042] This allows the generated input to be checked for similarity to the original input. This enables finer control of the debugging process and can help filter out less relevant inputs. The use of cardinality or distance metrics allows for a quantitative evaluation. Cardinality, in particular, describes the number of possible values ​​at which the input leads to the error during the execution of the software program. Distance metrics such as the Levenshtein distance, in particular, measure a minimum number of R.416140

[0043] - 7 -

[0044] Operations required to transform one string into another, i.e., the at least one generated input into the provided input. The Levenshtein distance, for example, considers three basic operations: inserting a character, deleting a character, and replacing a character. Specifically, the Levenshtein distance is defined as the minimum number of these operations required to perform the transformation.

[0045] Furthermore, it is advantageous if, within the scope of the invention, at least one criterion is the approval of a user, in particular a data owner in the provided input (English: “Data owner”), i.e., a user to whom the sensitive data pertains or from whom the sensitive data in the provided input originates, wherein the verification of the at least one generated input comprises:

[0046] Initiating an output to the user, whereby the output is used to request the user's approval, the output may include, for example, a visual text window and / or an input mask via a display and / or an acoustic output via a loudspeaker; receiving the user's approval or a rejection by the user, whereby in the case of rejection, the provisioning is not carried out and / or the generation is carried out again.

[0047] Approval or rejection can be granted by the user, for example, via a mouse click, text command, or even an audible command. This allows the user to control the generated input. User approval ensures that only input data deemed acceptable by the user for debugging purposes, such as by a third party like a developer. This can increase security and minimize the risk of potentially sensitive data being executed.

[0048] Another possibility is that, during the determination process, a symbolic and / or a conclusive execution is guided through a path to a concrete execution of the software program with the provided input. For example, the concrete execution of the software program with the provided input R.416140 can first be performed.

[0049] - 8 -

[0050] The symbolic execution is then carried out, and subsequently the symbolic execution is guided along the path of the concrete execution. This reduces the computational effort involved in determining the result, which would otherwise be required with a purely symbolic execution.

[0051] Symbolic execution is a technique for analyzing software programs where they are executed using symbolic input values ​​instead of concrete values. These symbolic values ​​represent, for example, general inputs and allow for the analysis of the control flow and constraints of the software program. The goal is, in particular, to examine all possible execution paths through the software program. The technique generates constraints that describe the relationships between the symbolic inputs and program outputs. These constraints can be checked, for example, in a constraint solver engine to determine whether they are satisfyable.

[0052] Concolic execution combines symbolic and concrete execution to make the analysis of software programs more efficient. According to the invention, the software program is executed sequentially with real input values ​​(concrete), i.e., with the provided input, and subsequently with symbolic values. The concrete execution can provide a specific execution of the program, allowing the symbolic execution to determine the conditions for this concrete execution.

[0053] It is conceivable that the procedure may also include:

[0054] Transferring the at least one error-inducing input to an external data processing device in order to provide the use of the at least one error-inducing input on the external data processing device for debugging the software program.

[0055] The external data processing device can be operated, for example, by a developer and can be used in particular for debugging the software program. Debugging can be carried out manually coordinated by the developer and / or automatically. R.416140

[0056] - 9 -

[0057] The method according to the invention thus allows an independent third party to advantageously perform the troubleshooting for the software program, even if sensitive data is present in the error-triggering input.

[0058] The invention also relates to a computer program, in particular a computer program product, comprising instructions which, when executed by at least one computer, cause it to execute the method according to the invention. Thus, the computer program according to the invention offers the same advantages as those described in detail with reference to a method according to the invention.

[0059] The invention also relates to a data processing device configured to execute the method according to the invention. The device can, for example, comprise at least one computer which executes the computer program according to the invention. The computer can have at least one processor for executing the computer program. A non-volatile data storage device can also be provided in which the computer program is stored and from which the computer program can be read by the processor for execution.

[0060] The invention may also relate to a computer-readable storage medium which contains the computer program according to the invention and / or includes instructions which, when executed by at least one computer, cause it to execute the method according to the invention. The storage medium is, for example, designed as a data storage device such as a hard drive and / or non-volatile memory and / or a memory card. The storage medium can, for example, be integrated into the computer.

[0061] Furthermore, the method according to the invention can also be implemented as a computer-implemented method. Alternatively or additionally, at least one of the disclosed method steps can be computer-implemented and / or carried out automatically. R.416140

[0062] - 10 -

[0063] Further advantages, features, and details of the invention will become apparent from the following description, in which exemplary embodiments of the invention are described in detail with reference to the drawings. The features mentioned in the claims and in the description can each be essential to the invention individually or in any combination. The drawings show:

[0064] Fig. 1 shows a schematic visualization of a method, a device, a storage medium and a computer program according to exemplary embodiments of the invention.

[0065] Fig. 2 shows a schematic representation of a device, a software program and an external data processing device according to exemplary embodiments of the invention.

[0066] Fig. 1 schematically shows a method 100, a device 10, a storage medium 15 and a computer program 20 according to exemplary embodiments of the invention.

[0067] Fig. 1 shows, in particular, an embodiment of a method 100 for generating at least one error-triggering input for debugging in a software program 1. In a first step 101, an input is provided that leads to an error during execution of the software program 1. In a second step 102, individual logical conditions within the software program 1 are determined that are satisfied when the error occurs during execution of the software program 1. In a third step 103, a further logical condition is provided, according to which a generated input must be different from the provided input. In a fourth step 104, at least one input is generated that satisfies the determined individual logical conditions as well as the provided further logical condition.In a fifth step 105, it is checked whether at least one generated input leads to the error during the execution of the software program ms 1. In a sixth step 106, the at least one checked input is used as the at least one error-triggering input for troubleshooting in R.416140.

[0068] - 11 -

[0069] Software program 1 is provided if it leads to the error during the execution of software program 1.

[0070] Fig. 2 shows a schematic representation of a device 10 on which a software program 1 is implemented, and an external data processing device 2 according to exemplary embodiments of the invention. The device 10 can provide a trusted execution environment (TEE) within which the software program 1 is executed. The device 10 can transmit the at least one error-triggering input to the external data processing device 2 in order to provide the use of the at least one error-triggering input on the external data processing device 2 for debugging in the software program 1.

[0071] Any input that causes the same error as the provided input (containing sensitive data) can be sufficient for error correction. According to the invention, an equivalent error-triggering input can therefore be derived that includes no or less sensitive or private data, which can then be provided to a developer for error correction.

[0072] According to exemplary embodiments of the invention, parts of the concolic execution are used to collect logical input constraints that lead to the error of software program 1. Initially, these logical constraints lead, in particular, to the original input. Therefore, in a next step, non-essential logical constraints can be identified and removed. When only the essential logical constraints remain, a constraint solver can generate various inputs that cause the same error in the execution of software program 1. Furthermore, a decision can be made as to whether the generated inputs, which may still reveal sensitive or private data, can be disclosed for error correction.

[0073] - 12 -

[0074] The method according to exemplary embodiments of the invention, which is described below, allows changes in the input to be maximized while maintaining the same behavior.

[0075] As a first step, logical conditions for a given input can be collected that lead to an error in software program 1. Symbolic and / or concolic execution can be used for this purpose. The given input, or a corresponding input buffer or input interface, can be declared as a symbolic variable. Alternatively, symbolic execution can be used to trigger the error. Alternatively, a trace of the actual execution can be performed, and within the symbolic execution, the error can be triggered by discarding any deviations in the software program state during the symbolic execution.

[0076] As a possible addition to the first step, the logical conditions can be evaluated to identify those that are essential for causing the error. Each logical condition can therefore first be negated. Subsequently, it can be tested whether the error (path) is still reachable using symbolic execution. If it is still reachable, the logical condition is not essential and can be ignored; that is, it can remain negated. If the error is no longer reachable, the logical condition is essential and can be restored to avoid being negated.

[0077] In a second step, a further logical condition can be added, or provided, according to which an inequality between a generated input and the provided input is required, or in other words, according to which the generated, or symbolic, input must not be equal to the provided concrete input.

[0078] In a third step, a constraint solver can be used to generate inputs that satisfy all conditions. R.416140

[0079] - 13 -

[0080] In a fourth step, it can be checked whether the generated inputs cause the same error as the original input provided.

[0081] In a fifth, optional step, it can be verified that the generated inputs do not disclose any sensitive or private information. One possible solution is to use a Disclosure Policy Engine that evaluates an application-specific set of criteria, or policies. A criterion can be assessed against the generated inputs, either granting or denying their disclosure. Criteria can be combined using logical operators such as AND, OR, and NOT.

[0082] Criteria can implement any logic. Examples of criteria include: The cardinality of the generated input set can be evaluated, and disclosure is only permitted if the cardinality exceeds a defined threshold. Additionally or alternatively, a distance metric, such as the Levenshtein distance, to the original input can be calculated, and disclosure is only permitted if the calculated distance exceeds a defined threshold. Additionally or alternatively, a user, particularly the data owner, or another person who must give their consent, can be asked whether the generated input may be disclosed.

[0083] In a sixth step, the generated inputs that caused the error and preferably do not contain sensitive data, i.e., those that have passed the aforementioned check, can be returned.

[0084] An advantageous implementation of the invention can use a symbolic / concrete execution machine such as "Angr" for symbolic and / or concolic execution (see "F. Gritti et al., "SYMBION: Interleaving Symbolic with Concrete Execution", 2020 IEEE Conference on Communications and Network Security (CNS), Avignon, France, 2020, pp. 1-10, doi:

[0085] 10.1109 / CNS48642.2020.9162164."). The input to the software program can initially be declared as symbolic. Since a concrete input exists, the variant in which a path to the concrete execution is preserved and the symbolic execution is led to the error R.416140 with the path is preferred.

[0086] - 14 -

[0087] As mentioned above, this will be the most promising way to find limitations causing the error in a reasonable amount of time.

[0088] The preceding explanation of the embodiments describes the present invention exclusively by way of examples.

[0089] Of course, individual features of the embodiments can be freely combined with one another, provided this is technically feasible, without leaving the scope of the present invention.

Claims

R.416140 - 15 - Claims 1. Method (100) for generating at least one error-triggering input for error detection in a software program (1), comprising: Providing (101) an input that will cause an error during execution of the software program (1), Determine (102) individual logical conditions within the software program ms (1) that are satisfied when the error occurs during the execution of the software program ms (1), provide (103) a further logical condition according to which an inequality of a generated input with the provided input is required, Generate (104) at least one input that satisfies the determined individual logical conditions as well as the provided further logical condition, Check (105) whether at least one generated input leads to the error during the execution of the software program (1), Providing (106) the at least one checked input as the at least one error-triggering input for debugging in the software program (1) if it leads to the error during the execution of the software program (1). R.416140 - 16 - 2. Method (100) according to claim 1 , characterized by that the procedure (100) further includes: Negating the identified individual logical conditions, whereby the negation is performed individually for each of the identified individual logical conditions. Checking whether a path of the error in the software program (1) is still reachable after negation, wherein the check is performed individually for each of the determined individual logical conditions after negation, Filtering the identified individual logical conditions depending on the respective result of the check.

3. Method (100) according to one of the preceding claims, characterized in that that the generation (104) of at least one input is performed using a combined logic problem solver.

4. Method (100) according to one of the preceding claims, characterized in that that the input provided includes sensitive data and the procedure (100) further includes: Checking the at least one generated input on the basis of at least one criterion to determine whether the at least one generated input discloses the sensitive data, wherein the provision (106) is only carried out if a result of the check indicates that the at least one generated input does not disclose the sensitive data.

5. Method (100) according to claim 4, characterized by that at least one criterion is a cardinality of the at least one generated input and / or a distance metric for evaluating a distance to the provided input. R.416140 - 17 - 6. Method (100) according to claim 4 or 5, characterized by that at least one criterion is user authorization, including checking the at least one generated input: Initiating an output to the user, whereby the user's permission is requested via the output, Receiving the user's approval or rejection, whereby in the case of rejection the provisioning (106) is not carried out and / or the generation (104) is carried out again.

7. Method (100) according to one of the preceding claims, characterized in that that, in the context of the determination (102), a symbolic and / or a conciliar execution is guided by a path of a concrete execution of the software program (1) with the provided input.

8. Method (100) according to any one of the preceding claims, characterized in that that the procedure (100) further includes: Transferring the at least one error-inducing input to an external data processing device (2) in order to provide the use of the at least one error-inducing input on the external data processing device (2) for debugging in the software program (1).

9. Computer program (20), comprising instructions which, when the computer program (20) is executed by at least one computer (10), cause it to execute the method (100) according to one of the preceding claims.

10. Device (10) for data processing, configured to perform the method (100) according to any one of claims 1 to 8. R.416140 - 18 - 11. Computer-readable storage medium (15) comprising instructions which, when executed by at least one computer (10), cause it to execute the steps of the method (100) according to any one of claims 1 to 8.

Images