Search

At present, various types of code vulnerabilities lead to a huge workload of detection. Although multi-party cooperation detection methods can be applied to improve efficiency, common crowdsourcing models are difficult to guarantee the privacy of code and identity. We design a code and identity privacy vulnerability crowdsourcing detection system ConGradetect. The system is built on a blockchain and solves code privacy issues, identity privacy issues, and reward preemption issues during the crowdsourcing detection process of vulnerabilities. In ConGradetect, users have a dynamic fake identity, which ensures that the identity of the user is not exposed, thereby avoiding the problem of information exposure caused by data accumulation. In the meantime, ConGradetect uses a local code granulation tool to perform off-line code cutting for task publishers, and uses proxy re-encryption to allocate task code blocks to ensure that the complete original code is only known to the code owner. When the task is received, a trusted key conversion is performed using smart contract. Further, we propose a method for anonymous verification of the binding relationship between task and user to prevent reward preemption and ensure that task performers can obtain corresponding legal benefits. Finally, we run the system on the Ethereum blockchain and test its performance. After testing, the feasibility of ConGradetect is proved. [ABSTRACT FROM AUTHOR]