一句话:提出 trace-wringing,在保留关键特征的同时尽量去除程序轨迹中的敏感信息,并验证内存轨迹的可行性与泄漏边界。
在应用定制系统开发中,开发者常需要在共享信息与隐藏信息之间权衡。程序轨迹(如内存地址轨迹)的发布可能泄露用户身份、行为、计算细节甚至侧信道信息,而手工构造不含敏感数据的“类比”轨迹或高层描述往往低效且易造成困惑。作者提出 trace-wringing 这一新问题:在删除尽可能多信息的同时保留原轨迹的关键特征,并对其形式化。针对内存轨迹实例,他们表明只需共享数千比特即可。实验显示,trace-wrung 代理在缓存模拟中与原轨迹表现相似且泄漏有界,并进一步考察了拧除轨迹对一类 AES 加密攻击的敏感性。
When working towards application-tuned systems, developers often find themselves caught between the need to share information (so that partners can make intelligent design choices) and the need to hide information (to protect proprietary methods or sensitive data). One place where this problem comes to a head is in the release of program traces, for example a memory address trace. A trace taken from a production server might expose details about who the users are or what they are doing, or it might even expose details of the actual computation itself (e.g. through a side channel). Engineers are often asked to make, by hand, "analogs" of their codes that would be free from such sensitive data or, may even try to describe behaviors at a high level with words. Both of these approaches lead to missed opportunities, confusion, and frustration. We propose a new problem for study, trace-wringing, that seeks to remove as much information from the trace as possible while still maintaining key characteristics of the original. We formalize this problem and show that, for a specific instance around memory traces, as little as a few thousand bits need to be shared. We demonstrate experimentally that the trace-wrung proxies behave similarly in the context of cache simulation but with bounded leakage, and examine the sensitivity of wrung traces to a class of attacks on AES encryption.