Abstract:Software composition analysis (SCA) denotes the process of identifying open-source software components in an input software application. SCA has been extensively developed and adopted by academia and industry. However, we notice that the modern SCA techniques in industry scenarios still need to be improved due to privacy concerns. Overall, SCA requires the users to upload their applications' source code to a remote SCA server, which then inspects the applications and reports the component usage to users. This process is privacy-sensitive since the applications may contain sensitive information, such as proprietary source code, algorithms, trade secrets, and user data. Privacy concerns have prevented the SCA technology from being used in real-world scenarios. Therefore, academia and the industry demand privacy-preserving SCA solutions. For the first time, we analyze the privacy requirements of SCA and provide a landscape depicting possible technical solutions with varying privacy gains and overheads. In particular, given that de facto SCA frameworks are primarily driven by code similarity-based techniques, we explore combining several privacy-preserving protocols to encapsulate the similarity-based SCA framework. Among all viable solutions, we find that multi-party computation (MPC) offers the strongest privacy guarantee and plausible accuracy; it, however, incurs high overhead (184 times). We optimize the MPC-based SCA framework by reducing the amount of crypto protocol transactions using program analysis techniques. The evaluation results show that our proposed optimizations can reduce the MPC-based SCA overhead to only 8.5% without sacrificing SCA's privacy guarantee or accuracy.

Privacy-preserving Technology and Its Applications in Statistics Measurements

Semantic Security: Privacy Definitions Revisited.

A Privacy Framework: Indistinguishable Privacy

Secure Multiparty Computation of Statistical Distribution

Privacy‐preserving statistical computing protocols for private set intersection

Privacy-preserving Data Aggregation Without Secure Channel: Multivariate Polynomial Evaluation

Guarding Multiple Secrets: Enhanced Summary Statistic Privacy for Data Sharing

A Sampling-Based Method for Highly Efficient Privacy-Preserving Data Publication.

Preserving Privacy in Software Composition Analysis: A Study of Technical Solutions and Enhancements

The Privacy Preserving Technology in Data Mining

Privacy preserving sort algorithm

Improving Utility of Differentially Private Mechanisms through Cryptography-based Technologies: a Survey

A New Method on Personalized Privacy Preserving Multi-classification

New Privacy Mechanism Design With Direct Access to the Private Data

Privacy Preserved Self-Awareness on the Community Via Crowd Sensing

An Algorithmic Method for Tampering-Proof and Privacy-Preserving Smart Metering

Privacy-preserving Judgment of the Intersection for Convex Polygons.

A Summary of Privacy-Preserving Data Publishing in the Local Setting

Privacy preserving computation of trust-value in wireless sensor networks

Ensuring Semantic Validity in Privacy-Preserving Aggregate Statistics

Toward efficient and privacy-preserving computing in big data era