Time Travel Trace Debugging Sensitive Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Time travel debuggers record sensitive information, such as cryptographic data and personally identifiable information, which can lead to security concerns when used in production environments, as they capture and reveal sensitive data that should remain private.
Innovation Solution
The method involves identifying sensitive information during trace recording or later and removing or masking it, by storing alternative data or replacing original instructions to ensure correct execution while preserving privacy, allowing time travel traces to be generated and consumed without revealing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If time travel debuggers record execution traces including memory values, then debugging capability is improved, but sensitive information security deteriorates
Solution Approach 1:
The patent extracts sensitive information from the execution trace by identifying it through criteria matching and removing or obscuring it before the trace is stored or displayed. This separates the useful debugging data from the harmful sensitive information, maintaining debugging capability while preventing security breaches.
Solution Approach 2:
The patent performs preliminary identification and protection of sensitive information during the trace recording process itself, rather than as a post-processing step. By proactively detecting sensitive data through criteria matching and applying protection measures before the trace is fully captured or accessed, the system prevents sensitive information exposure while maintaining complete debugging functionality.
2Object-affected harmful factors
If sensitive information is removed or obscured from traces, then information security is improved, but trace data completeness deteriorates
Solution Approach 1:
The patent applies local quality by selectively protecting only the portions of trace data that contain sensitive information while leaving the rest of the trace data intact and fully accessible. This targeted approach ensures that debugging functionality remains complete for non-sensitive portions while providing security protection where needed.
Solution Approach 2:
The patent changes the state of sensitive information in the trace by transforming it from its original readable form to an obscured or removed state through criteria-based identification and protection mechanisms. This parameter change affects only the sensitive portions while maintaining the structural integrity and completeness of the overall trace data for debugging purposes.
3Productivity
If trace recording is performed in production systems, then debugging effectiveness is improved, but security risks deteriorate
Solution Approach 1:
The patent introduces an intermediary mechanism that sits between the trace recording process and the stored trace data. This intermediary actively monitors and identifies sensitive information using predefined criteria, and applies protection measures by removing or obscuring sensitive data before it becomes part of the permanent trace record. This allows production system debugging to proceed effectively while security risks are mitigated by the intermediary protection layer.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Protecting sensitive information in connection with tracing an original execution of an entity. Embodiments include identifying that original information-which was accessed based on an original execution of one or more original executable instructions of the entity-comprises sensitive information. Based on the original information comprising the sensitive information, embodiments include performing one or both of (i) storing first trace data comprising alternative information-rather than the original information-into the trace, while ensuring that an execution path that was taken by the entity based on the original information is also taken during replay of the original execution of the entity using the trace; or (ii) storing second trace data into the trace that causes zero or more alternative executable instructions-rather than the one or more original executable instructions of the entity-to be executed during the replay of the original execution of the entity.