동형 암호를 활용한 프라이버시 보장 암호화 API 오용 탐지 프레임워크
Privacy-Preserving Cryptographic API Misuse Detection Framework Using Homomorphic Encryption
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 연구에서는 동형 암호를 활용한 프라이버시 보장 암호화 API 오용 탐지 프레임워크를 제안한다. 제안하는 프레임워크는 암호화된 상태에서 데이터의 기밀성을 유지하면서도 효과적으로 암호화 API 오용을 탐지할 수 있도록 설계되었다. 먼저, CNN(Convolutional Neural Network) 기반의 탐지 모델을 사용하고, 암호화된 환경에서도 높은 정확도를 유지하기 위해 모델 구조를 최적화하였다. 구체적으로, 효율적인 동형 암호 연산을 위해 깊이별 합성곱층을 활용하고, 비선형성을 확보하기 위해 세제곱 활성화 함수를 도입하여 암호화된 데이터에서도 오용 탐지를 효과적으로 수행할 수 있도록 하였다. 실험 결과, 제안된 모델은 F1 스코어 0.978의 높은 탐지 성능을 보였으며, 동형 암호를 적용한 모델의 전체 실행 시간은 11.20초로, 실시간 처리에 가까운 계산 효율성을 보여주었다. 이러한 결과는 동형 암호를 활용한 환경에서도 우수한 보안성과 정확도를 제공할 수 있음을 확인시켜준다.
Abstract
In this study, we propose a privacy-preserving cryptographic API misuse detection framework utilizing homomorphic encryption. The proposed framework is designed to effectively detect cryptographic API misuse while maintaining data confidentiality. We employ a Convolutional Neural Network (CNN)-based detection model and optimize its structure to ensure high accuracy even in an encrypted environment. Specifically, to enable efficient homomorphic operations, we leverage depth-wise convolutional layers and a cubic activation function to secure non-linearity, enabling effective misuse detection on encrypted data. Experimental results show that the proposed model achieved a high F1-score of 0.978, and the total execution time for the homomorphically encrypted model was 11.20 seconds, demonstrating near real-time processing efficiency. These findings confirm that the model offers excellent security and accuracy even when operating in a homomorphic encryption environment.
참고문헌 (14)
- S. Ma, "Cdrep: Automatic Repair of Cryptographic Misuses in Android Applications", Proceedings of the 11th ACM on Asia conference on computer and communications security, pp.711~722 (2016)
- S. Rahaman, "Cryptoguard:High Precision Detection of Cryptographic Vulnerabilities in Massive-Sized Java Projects", Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp.2455~2472 (2019)
- M. Egele, "An Empirical Study of Cryptographic Misuse in Android Applications", Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, pp.73~84 (2013)
- D.C. Nguyen, "A Stitch in Time: Supporting Android Developers in Writing Secure Code", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.1065~1077 (2017)
- I. Muslukhov, "Source Attribution of Cryptographic API Misuse in Android Applications", Proceedings of the 2018on Asia Conference on Computer and Communications Security, pp.133~146 (2018)
- J. H. Cheon, "Homomorphic Encryption for Arithmetic of Approximate Numbers", Proceedings of ASIACRYPT 2017:23rd International Conference on the Theory and Applications of Cryptology and Information Security, pp.409~437 (2017)
- H. Baek, "Crypto-LLM: Harnessing the Power of LLMs to Detect Cryptographic API Misuse", European Symposium on Research in Computer Security, pp.353~373 (2024)
- K. Allix, "Androzoo: Collecting Millions of Android Apps for the Research Community", Proceedings of the 13th International Conference on Mining Software Repositories, pp.468~471 (2016)
- S. Krüger, "Cognicrypt: Supporting Developers in Using Cryptography", 2017 32nd IEEE, 2017, 931~936
- "SpotBugs" (2024)[URL]
- A.S. Ami, "MASC : A Tool for Mutation-Based Evaluation of Static Crypto-API Misuse Detectors", Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp.2162~2166 (2023)
- "SEAL-Python" (2024)[URL]
- H. Choi, "UniHENN : Designing Faster and More Versatile Homomorphic Encryption-based CNNs without im2col", IEEE Access, 12, pp.109323~109341 (2024)