8
비밀 프로그램 정적분석 1 이우석, 2 홍현숙, 2 천정희, 1 이광근 1 서울대학교 컴퓨터공학부 프로그래밍 연구실 2 서울대학교 수리과학부 암호학적 난제 연구단 Sunday, February 8, 15

비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

비밀����������� ������������������  프로그램����������� ������������������  정적분석

1이우석,����������� ������������������  2홍현숙,����������� ������������������  2천정희,����������� ������������������  1이광근

1서울대학교����������� ������������������  컴퓨터공학부����������� ������������������  프로그래밍����������� ������������������  연구실

����������� ������������������  2서울대학교����������� ������������������  수리과학부����������� ������������������  암호학적����������� ������������������  난제����������� ������������������  연구단

Sunday, February 8, 15

Page 2: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

비밀����������� ������������������  분석

Bug finder

?

?User

Program

Bug report

Sunday, February 8, 15

Page 3: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

응용

•견고한����������� ������������������  앱스토어����������� ������������������  리뷰����������� ������������������  시스템

•예����������� ������������������  :����������� ������������������  애플����������� ������������������  앱스토어,����������� ������������������  삼성앱스����������� ������������������  

•온라인����������� ������������������  분석����������� ������������������  서비스

•SW����������� ������������������  클리닉����������� ������������������  서비스

Sunday, February 8, 15

Page 4: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

가능하게����������� ������������������  하는����������� ������������������  열쇠����������� ������������������  :����������� ������������������  

동형암호

•암호문에����������� ������������������  연산한����������� ������������������  것이����������� ������������������  평문연산����������� ������������������  결과����������� ������������������  보존

•임의의����������� ������������������  연산이����������� ������������������  위����������� ������������������  성질����������� ������������������  만족시����������� ������������������  완전동형암호

Secret Static Analysis

Woosuk Lee

AbstractThis article proposes a protocol to provide a static analysis asa web-service maintaining client’s and server’s privacy. A clientwho requests a static analysis service does not want to revealhis code to a service provider, whileas the server wants to hideinformation about its static analysis from the client. The protocol isbased on the homomorphic encryption technique, which is capableof performing encrypted computation for given encrypted inputs.Based on the semantic security of a base encryption scheme, theprotocol prevents privacy leakages of each side.

1. IntroductionConsider a plausible situation: a client wants to use a static analysisservice without having to reveal its program code to a serviceprovider. On the other hand, the service provider wants to provideits static analyzer without revealing its technical know-how orreleasing a reusable binary executable to the client.

As a solution to this ironic situation, we devised an interactiveprotocol fulfilling the requirements of both sides. We provides away to perform secret static analysis for a given program on theclient side. Our secret static analysis protocol guarantees that 1)secret static analysis is totally secure, in the sense that attackerscan never grasp any piece of abstract domain on which the analysisis based, and 2) encrypted analysis results are correct, in the sensethat the decryption yields the very results of ordinary static analysisof input programs.

In this article, we present our protocol which is generally ap-plicable to static analysis based on finite abstract domain, and asan example, we show how a simple sign analysis is designed andperformed secretly on the protocol.

2. Preliminaries2.1 Basic conceptsPublic-key cryptosystem In public-key cryptosystem, anyone canencrypt messages using the public key, but only the holder of thepaired private key can decrypt. Security depends on the secrecy ofthe private key.

Probabilistic encryption Probabilistic encryption is the use ofrandomness in an encryption algorithm, so that when encryptingthe same message several times it will, in general, yield differentciphertexts. To hide even partial information about the plaintext, anencryption scheme must be probabilistic.

Homomorphic encryption Homomorphic encryption refers toencryption schemes that enable to perform operations on encrypteddata. A homomorphic encryption E is said to preserve an operationop if it provides op, an encrypted version of op, such that for a plaintext m,

op(E(m)) ⌘ E(op(m))

Fully Homomorphic Encryption Scheme If a homomorphic en-cryption scheme preserves any operations, it is said to be fully ho-

momorphic. A fully homomorphic encryption scheme[1] we con-sider preserves a series of addition(modulo 2) and multiplicationoperations, i.e., for plaintexts m1, m2 2 {0, 1},

E(m1) + E(m2) ⌘ E(m1 + m2)

E(m1) ⇥ E(m2) ⌘ E(m1 ⇥ m2)

Note that addition(modulo 2) and multiplication operators functionas boolean AND, XOR gates respectively. As an arbitrary circuitcan be encoded with AND, XOR gates, the above scheme preservesany operations.

Static Analysis We consider a static analysis designed by abstractinterpretation. In abstract interpretation, a static analysis is speci-fied with an abstract domain D and semantic function F : D ! D,where D is a cpo (complete partial order) and F is monotone. Theanalysis’ job is to compute the following sequence until stabilized:

G

i2NF

i(?) = F

0(?) t F

1(?) t F

2(?) t · · · (1)

where F

0(?) = ? and F

i+1(?) = F (F i(?)).

2.2 Notations•

mp : a ciphertext encrypted under p’s public key. Decryptionusing p’s private key yields the plaintext m. p may be eitherc(client) or s(server).

•mp1,p2

: a ciphertext multiply encrypted under p1’s and p2’spublic key. Decryption using both private keys results in theplaintext.

• opp

: a homomorphic version of operation op that permitscomputation on data encrypted under p’s public key.

• Dp : encrypted abstract domain under p’s public key. As anabstract domain consists of elements and abstract operators,encrypted abstract domain provides encryption algorithm forelements, and homomorphic abstract operators applicable toamong encrypted domain elements.

3. Protocol3.1 Assumptions1. A server and a client are “honest but curious” in the sense that

they run the protocol exactly as specified, but may try to learn asmuch as possible about the input of the other from their viewsof the protocol. Hence, we want the view of each side not toleak more knowledge than necessary.

2. A crucial part of information about static analysis is abstractdomain.

3. A base encryption scheme used in the protocol is public-keybased, probabilistic, semantically secure, and fully homomor-phic.

1 2013/12/19

Sunday, February 8, 15

Page 5: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

가능하게����������� ������������������  하는����������� ������������������  열쇠����������� ������������������  :����������� ������������������  

동형암호

•완전동형암호의����������� ������������������  간단한����������� ������������������  예:����������� ������������������  

•다음����������� ������������������  성질����������� ������������������  만족����������� ������������������  (이진����������� ������������������  덧셈(XOR),����������� ������������������  곱셈(AND)보존)����������� ������������������  

Secret Static Analysis

Woosuk Lee

AbstractThis article proposes a protocol to provide a static analysis asa web-service maintaining client’s and server’s privacy. A clientwho requests a static analysis service does not want to revealhis code to a service provider, whileas the server wants to hideinformation about its static analysis from the client. The protocol isbased on the homomorphic encryption technique, which is capableof performing encrypted computation for given encrypted inputs.Based on the semantic security of a base encryption scheme, theprotocol prevents privacy leakages of each side.

1. IntroductionConsider a plausible situation: a client wants to use a static analysisservice without having to reveal its program code to a serviceprovider. On the other hand, the service provider wants to provideits static analyzer without revealing its technical know-how orreleasing a reusable binary executable to the client.

As a solution to this ironic situation, we devised an interactiveprotocol fulfilling the requirements of both sides. We provides away to perform secret static analysis for a given program on theclient side. Our secret static analysis protocol guarantees that 1)secret static analysis is totally secure, in the sense that attackerscan never grasp any piece of abstract domain on which the analysisis based, and 2) encrypted analysis results are correct, in the sensethat the decryption yields the very results of ordinary static analysisof input programs.

In this article, we present our protocol which is generally ap-plicable to static analysis based on finite abstract domain, and asan example, we show how a simple sign analysis is designed andperformed secretly on the protocol.

2. Preliminaries2.1 Basic conceptsPublic-key cryptosystem In public-key cryptosystem, anyone canencrypt messages using the public key, but only the holder of thepaired private key can decrypt. Security depends on the secrecy ofthe private key.

Probabilistic encryption Probabilistic encryption is the use ofrandomness in an encryption algorithm, so that when encryptingthe same message several times it will, in general, yield differentciphertexts. To hide even partial information about the plaintext, anencryption scheme must be probabilistic.

Homomorphic encryption Homomorphic encryption refers toencryption schemes that enable to perform operations on encrypteddata. A homomorphic encryption E is said to preserve an operationop if it provides op, an encrypted version of op, such that for a plaintext m,

op(E(m)) ⌘ E(op(m))

Fully Homomorphic Encryption Scheme If a homomorphic en-cryption scheme preserves any operations, it is said to be fully ho-

momorphic. A fully homomorphic encryption scheme[1] we con-sider preserves a series of addition(modulo 2) and multiplicationoperations, i.e., for plaintexts m1, m2 2 {0, 1},

E(m1) + E(m2) ⌘ E(m1 + m2)

E(m1) ⇥ E(m2) ⌘ E(m1 ⇥ m2)

Note that addition(modulo 2) and multiplication operators functionas boolean AND, XOR gates respectively. As an arbitrary circuitcan be encoded with AND, XOR gates, the above scheme preservesany operations.

Static Analysis We consider a static analysis designed by abstractinterpretation. In abstract interpretation, a static analysis is speci-fied with an abstract domain D and semantic function F : D ! D,where D is a cpo (complete partial order) and F is monotone. Theanalysis’ job is to compute the following sequence until stabilized:

G

i2NF

i(?) = F

0(?) t F

1(?) t F

2(?) t · · · (1)

where F

0(?) = ? and F

i+1(?) = F (F i(?)).

2.2 Notations•

mp : a ciphertext encrypted under p’s public key. Decryptionusing p’s private key yields the plaintext m. p may be eitherc(client) or s(server).

•mp1,p2

: a ciphertext multiply encrypted under p1’s and p2’spublic key. Decryption using both private keys results in theplaintext.

• opp

: a homomorphic version of operation op that permitscomputation on data encrypted under p’s public key.

• Dp : encrypted abstract domain under p’s public key. As anabstract domain consists of elements and abstract operators,encrypted abstract domain provides encryption algorithm forelements, and homomorphic abstract operators applicable toamong encrypted domain elements.

3. Protocol3.1 Assumptions1. A server and a client are “honest but curious” in the sense that

they run the protocol exactly as specified, but may try to learn asmuch as possible about the input of the other from their viewsof the protocol. Hence, we want the view of each side not toleak more knowledge than necessary.

2. A crucial part of information about static analysis is abstractdomain.

3. A base encryption scheme used in the protocol is public-keybased, probabilistic, semantically secure, and fully homomor-phic.

1 2013/12/19

E(m) = m+ pq + 2✏

D(c) = (c mod p) mod 2

Sunday, February 8, 15

Page 6: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

첫����������� ������������������  걸음����������� ������������������  :����������� ������������������  비밀����������� ������������������  포인터����������� ������������������  분석

•어떤����������� ������������������  포인터����������� ������������������  참조가����������� ������������������  실행����������� ������������������  중����������� ������������������  어느����������� ������������������  변수/저장장소

를����������� ������������������  가릴킬����������� ������������������  수����������� ������������������  있는지����������� ������������������  분석

•거의����������� ������������������  모든����������� ������������������  분석의����������� ������������������  기본

•간단한����������� ������������������  연산(합집합,����������� ������������������  부분집합)만����������� ������������������  필요

•다른����������� ������������������  간단한����������� ������������������  집합����������� ������������������  제약분석들도����������� ������������������  비슷

•클로저����������� ������������������  분석,����������� ������������������  타입����������� ������������������  분석����������� ������������������  등

Sunday, February 8, 15

Page 7: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

그래프를����������� ������������������  이용한����������� ������������������  포인터분석

int xint *p, *q, *rint **w

q = &xp = qw = &pw = &r*w = q

p

q

r

w

{x}

{p,r}

������ ������ ���

p

q

r

w

{x}

{p,r}

p

q

r

w

{x}

{p,r}

{x}

{x}

Sunday, February 8, 15

Page 8: 비밀프로그램정적분석 - rosaec.snu.ac.krrosaec.snu.ac.kr/meet/file/20150128i.pdf · 비밀프로그램정적분석 1이우석,2홍현숙,2천정희,1이광근 1서울대학교컴퓨터공학부프로그래밍연구실

비밀분석화

•분석에����������� ������������������  필요한����������� ������������������  모든����������� ������������������  것����������� ������������������  암호화:

•그래프,����������� ������������������  각����������� ������������������  변수가����������� ������������������  가리키는����������� ������������������  주소

•프로그램����������� ������������������  명령어들����������� ������������������  암호화

•가장����������� ������������������  빠른����������� ������������������  최신����������� ������������������  동형암호����������� ������������������  로����������� ������������������  구현할����������� ������������������  예정

•쓸����������� ������������������  수����������� ������������������  있을����������� ������������������  수준의����������� ������������������  성능이����������� ������������������  예상됨

•자세한����������� ������������������  것은����������� ������������������  포스터에서.

Jung Hee Cheon and Damien Stehl. Fully homomorphic encryption over the integers revisited. In EUROCRYPT 2015 - 34th Annual International Conference on the Theory and Applications of Cryptographic Techniques. To appear.

Sunday, February 8, 15