Poster: Protecting Source Code Privacy When Hunting Bugs
Jielun Wu, Qingkai Shi · 2024
When proving to a third party that a software system is of high quality or bug-free, a software vendor may have to reveal the source code such that the third party can use a public or their own static code analyzer to check the code. However, revealing source code seriously damages the interests of software vendors as the source code often contains core technical details or even secrets. In this work, we propose a win-win solution that can help software vendors protect source code privacy to the greatest extent and, meanwhile, maximize the bug-detection capability of the third party. Our key idea is that a majority of source code information is not useful for bug detection. Thus, a software vendor only needs to reveal a little source code information --- a stripped binary together with minimal debug information (which is the carrier of source code information) --- to prove the software's quality. To realize this win-win solution, we propose an approach that minimizes critical debug information in a non-stripped binary while maintaining its positive impact on static bug detection. Evaluation results demonstrate that our approach can significantly reduce the size of debug information and retain only a minimal amount of source-level private information.