Abstract:Software composition analysis (SCA) denotes the process of identifying open-source software components in an input software application. SCA has been extensively developed and adopted by academia and industry. However, we notice that the modern SCA techniques in industry scenarios still need to be improved due to privacy concerns. Overall, SCA requires the users to upload their applications' source code to a remote SCA server, which then inspects the applications and reports the component usage to users. This process is privacy-sensitive since the applications may contain sensitive information, such as proprietary source code, algorithms, trade secrets, and user data. Privacy concerns have prevented the SCA technology from being used in real-world scenarios. Therefore, academia and the industry demand privacy-preserving SCA solutions. For the first time, we analyze the privacy requirements of SCA and provide a landscape depicting possible technical solutions with varying privacy gains and overheads. In particular, given that de facto SCA frameworks are primarily driven by code similarity-based techniques, we explore combining several privacy-preserving protocols to encapsulate the similarity-based SCA framework. Among all viable solutions, we find that multi-party computation (MPC) offers the strongest privacy guarantee and plausible accuracy; it, however, incurs high overhead (184 times). We optimize the MPC-based SCA framework by reducing the amount of crypto protocol transactions using program analysis techniques. The evaluation results show that our proposed optimizations can reduce the MPC-based SCA overhead to only 8.5% without sacrificing SCA's privacy guarantee or accuracy.

Privacy preserving sort algorithm

Privacy Preserving Distributed DBSCAN Clustering

Privacy Preserving C4.5 Algorithm over Horizontally Partitioned Data.

T-Closeness Slicing: A New Privacy-Preserving Approach for Transactional Data Publishing.

Privacy preserving distributed data mining based on secure multi-party computation

Verifiable distributed privacy data comparing and sorting method and device

Privacy Preserving ID3 Algorithm over Horizontally Partitioned Data

Secure multiparty quantum computation for summation and data sorting

Preserving Privacy in Software Composition Analysis: A Study of Technical Solutions and Enhancements

Privacy Preserving Distributed Permutation Test

SHAPER: A General Architecture for Privacy-Preserving Primitives in Secure Machine Learning.

Quantum Secure Clockwise Sorting

A Privacy Preserving Outlier Detection Algorithm Based on Connected Domain

Efficient and Privacy-Preserving Multi-Party Skyline Queries Over Encrypted Data

Block-SMPC: A Blockchain-based Secure Multi-party Computation for Privacy-Protected Data Sharing

PSA: Private Set Alignment for Secure and Collaborative Analytics on Large-Scale Data

Privacy‐preserving statistical computing protocols for private set intersection

Towards Secure and Practical Machine Learning Via Secret Sharing and Random Permutation

Multi-Party Private Set Intersection: A Circuit-Based Protocol with Jaccard Similarity for Secure and Efficient Anomaly Detection in Network Traffic

Privacy-Preserving Machine Learning Algorithms for Big Data Systems

Privacy-preserving Data Aggregation Without Secure Channel: Multivariate Polynomial Evaluation