Techniques for secure debugging and monitoring
View Patent ↗Techniques for secure debugging and monitoring are presented. An end user requests a secure token for logging information with a remote service. A secure monitoring and debugging token service provides the secure token. The remote service validates the secure token and configures itself for capturing information and reporting the captured information based on the secure token.
1. A method implemented in a non-transitory machine-readable storage medium and processed by a device configured to perform the method, comprising:
receiving, by a Secure Monitoring and Debugging Token Service (SMDTS) executing on the device, selections for logging information with a remote service, the selections identifying what monitoring information that is to be produced by and retained by the remote service, and the selections made by a principal, the principal desiring interaction with the remote service and the selections for the logging information captured by the remote service during that interaction, wherein the remote service is external to a principal device operated by the principal;
evaluating, by the SMDTS, a policy to determine whether the selections are permissible;
generating, by the SMDTS, a secure token that defines a principal identity for the principal, roles for the principal, and a remote service identity for the remote service, and specific logging levels for the selections as permitted by the policy;
sending, by the SMDTS over a network connection, the secure token to the principal as a signed security assertion token;
receiving, by the SMDTS, the secure token over a secure or non-secure communication channel from the remote service;
validating, by the SMDTS, the secure token; and
returning, by the SMDTS, the specific logging levels permitted by the policy to the remote service based on the validated secure token.
2. The method of claim 1 further comprising, sending, by the SMDTS, the signed and encrypted secure token to the remote service.
3. The method of claim 1 , wherein receiving further includes receiving the selections directly from the principal.
4. The method of claim 1 , wherein receiving further includes receiving the selections from the remote service on behalf of the principal who is interacting with the remote service.
5. The method of claim 1 , wherein evaluating further includes using the principal identity and the remote service identity for the remote service to select the policy.
6. The method of claim 1 , wherein evaluating further includes using the policy to define in the secure token where the logged information defined by the selections is to be sent.
7. The method of claim 6 , wherein using further includes defining an auditing service as one recipient of the logged information and the principal as another recipient of the logged information.
8. A method implemented in a non-transitory machine-readable storage medium and processed by a server configured to perform the method, comprising:
receiving, by a remote network logging service executing on the server, a secure token that defines a logging level for monitoring data to configure for interactions with a principal and defines what information to capture for that logging level, and the secure token defining roles, and a principal identity for the principal, and the secure token produced by the principal making selections, wherein the secure token is an encrypted and signed security assertion token, the principal interacting with the remote network logging service from a principal device operated by the principal and the remote network logging service external to the principal device;
validating, by the remote network logging service, the secure token over a secure communication channel by sending the secure token to a remote service and receiving from the remote service the logging level with an indication that the secure token is validated;
configuring, by the remote network logging service, the logging level for capturing the monitoring data during the interactions with the principal on the server; and
capturing, by the remote network logging service logging information corresponding with the logging level during the interactions with the principal.
9. The method of claim 8 further comprising, sending the logging information to the principal device of the principal and to an auditing service.
10. The method of claim 8 , wherein receiving further includes acquiring the secure token from the principal.
11. The method of claim 8 , wherein receiving further includes interacting with a secure monitoring and debugging token service to acquire the secure token on behalf of the principal.
12. The method of claim 8 , wherein validating further includes interacting with a secure monitoring and debugging token service to perform the validation, wherein the secure monitoring and debugging token service is the remote service.
13. A system, comprising:
a device having memory configured with a secure monitoring and debugging token service (SMDTS) processing on the target device; and
a server having memory configured with a logging service processing on the server;
wherein the SMDTS is configured to generate a secure token based on a policy evaluation that defines a logging level for the logging service to use when interacting with a principal while the principal interacts with the logging service over a network connection from a principal device operated by the principal, the secure token produced by selections of the principal and identify what information to produce for the logging level and the information produced from the logging level produced by the logging service and retained by the logging service on the server, and the secure token defines a principal identity for the principal and roles, and wherein the SMDTS is configured to validate the secure token for the logging service, and the logging service is configured to capture logging data in accordance with the logging level and report the logging data to an auditing service, and wherein the SMDTS is configured to encrypt the secure token and provide the secure token to the principal as a security assertion token, and wherein the SMDTS is configured to: i) receive the secure token over a secure or non-secure communication channel from the logging service, ii) validate the secure token, and iii) return the logging level permitted by the policy to the logging service based on the validated secure token.
14. The system of claim 13 , wherein the SMDTS is configured to sign the secure token.