System and method for managing SBOM using blockchain

Abstract

Disclosed are a system and a method for managing SBOM using a blockchain. The system for managing SBOM according to one disclosed embodiment comprises: one or more project servers that perform a project on the basis of one or more pieces of software including one or more open sources, generate SBOM-related information including the SBOM and vulnerability information for each open source included in the software, and transmit an SBOM registration request including the SBOM-related information; and a blockchain network that includes a plurality of nodes, receives the SBOM registration request, generates an SBOM blockchain table on the basis of the SBOM-related information, and stores the generated SBOM blockchain table in each of the plurality of nodes.

Description

SBOM management system and method using blockchain

[0001] An embodiment of the present invention relates to a SBOM (Software Bill Of Materials) management technology using blockchain.

[0002] Recently, the use of open source in software development and distribution has been steadily increasing. Open source utilization is on the rise, with over 80% of source code now being open source. However, open source software has vulnerabilities, making it a target for hackers. Therefore, it is necessary to mitigate and manage security vulnerabilities when developing software using open source.

[0003] An embodiment of the present invention provides a new technique for managing an open source SBOM included in software.

[0004] An SBOM management system according to one embodiment disclosed comprises: one or more project servers that perform a project based on one or more software including one or more open sources, generate an SBOM (Software Bill Of Materials) and SBOM-related information including vulnerability information for each open source included in the software, and transmit an SBOM registration request including the SBOM-related information; And a blockchain network composed of a plurality of nodes, receiving the SBOM registration request, creating an SBOM blockchain table based on the SBOM-related information, and storing the created SBOM blockchain table in each of the plurality of nodes, wherein the items included in the SBOM include at least one of a supplier name, a component name, a component version string, a component hash, a unique identifier, a relationship, an author name, and a time stamp, and the vulnerability information includes at least one of vulnerability content information and vulnerability level information, and the blockchain network extracts each item from the SBOM of the SBOM-related information, extracts each item from the vulnerability information of the SBOM-related information, and creates an SBOM blockchain table composed of the extracted items, and the blockchain network extracts preset items from the SBOM to create a first blockchain hash, and creates a second blockchain hash based on the vulnerability information, and stores the first blockchain hash and The above second blockchain hash can be stored by matching it with the SBOM blockchain table.

[0005] The blockchain network extracts a supplier name, a component name, and a component version from the SBOM, collates them into a single string, and applies a hash function to the collated string to generate a first blockchain hash. The first blockchain hash may be arranged to have a bit length different from a hash value of a component among the items of the SBOM.

[0006] The blockchain network can generate a first blockchain hash by excluding an item with the lowest priority according to the priority set among the items, if the length of the string combining the supplier name, component name, and component version exceeds a preset threshold length.

[0007] When a project to be performed based on one or more software is given, the project server verifies each open source included in the software, and sends an inquiry to the blockchain network regarding whether SBOM is stored for each open source, and the blockchain network verifies whether SBOM-related information corresponding to the inquiry regarding whether SBOM is stored is stored in the SBOM blockchain table, and can send an inquiry response to the corresponding project server.

[0008] The project server, when receiving the inquiry response, if SBOM-related information among the open sources of the software is stored in the blockchain network based on the inquiry response, receives and stores SBOM-related information of the open source from the blockchain network, and if SBOM-related information among the open sources of the software is not stored in the blockchain network, generates SBOM-related information including SBOM and vulnerability information for the open source, and transmits an SBOM registration request including the generated SBOM-related information to the blockchain network.

[0009] The project server may transmit an SBOM verification request to the blockchain network when the project is started or while the project is being performed, extract preset items from the SBOM items of the open source included in the software to generate a first hash value, generate a second hash value based on vulnerability information of the open source, and include the first hash value and the second hash value in the SBOM verification request.

[0010] When the blockchain network receives the SBOM verification request, it can extract a first blockchain hash and a second blockchain hash that match the SBOM-related information from the SBOM blockchain table, and compare the extracted first blockchain hash and the second blockchain hash with the first hash value and the second hash value included in the SBOM verification request, and transmit the SBOM verification result to the project server.

[0011] The blockchain network stores project-related information (including project name, software used to perform the project, and information on open source included in the software) related to a project being performed on each project server, and, if SBOM-related information is falsified as a result of the SBOM verification, the blockchain network extracts the project-related information, and extracts a project server on which an open source corresponding to the SBOM-related information in which the falsification has occurred based on the project-related information, and transmits a falsification warning alarm for the open source to the extracted project server.

[0012] The blockchain network calculates project usage based on at least one of the number of times and frequency of use on project servers for each open source corresponding to the SBOM blockchain table, and when the project usage of the open source exceeds a preset threshold, a message may be sent to the project server using the open source to request an SBOM verification for the open source.

[0013] A SBOM management method according to one embodiment disclosed comprises the steps of: generating, in a project server that performs a project based on one or more software including one or more open sources, SBOM-related information including a Software Bill Of Materials (SBOM) and vulnerability information for each open source included in the software, and transmitting an SBOM registration request including the SBOM-related information; And a step of receiving the SBOM registration request in a blockchain network composed of a plurality of nodes, creating an SBOM blockchain table based on the SBOM-related information, and storing the created SBOM blockchain table in each of the plurality of nodes, wherein the items included in the SBOM include at least one of a supplier name, a component name, a component version string, a component hash, a unique identifier, a relationship, an author name, and a time stamp, and the vulnerability information includes at least one of vulnerability content information and vulnerability level information, and the storing step extracts each item from the SBOM of the SBOM-related information in the blockchain network, extracts each item from the vulnerability information of the SBOM-related information, and creates an SBOM blockchain table composed of the extracted items, extracts preset items from the SBOM to create a first blockchain hash, creates a second blockchain hash based on the vulnerability information, and stores the first blockchain hash in the SBOM. And the second blockchain hash can be stored by matching it with the SBOM blockchain table.

[0014] According to the disclosed embodiment, when conducting a project based on software that includes one or more open source software, the integrity of the SBOM-related information regarding the open source software can be preserved by storing and managing it via blockchain. This allows for easy identification and action to be taken in the event of falsification or alteration of the SBOM-related information. Furthermore, each project server can use the SBOM-related information to identify vulnerabilities in the corresponding open source software and reliably address them.

[0015] FIG. 1 is a diagram illustrating a SBOM (Software Bill Of Materials) management system using blockchain according to one embodiment of the present invention.

[0016] FIG. 2 is a diagram schematically showing a state in which a forgery warning alarm is transmitted in an SBOM management system according to one embodiment of the present invention.

[0017] Figure 3 is a flowchart for explaining a method for managing SBOM using blockchain according to one embodiment of the present invention.

[0018] FIG. 4 is a block diagram illustrating a computing environment including a computing device suitable for use in exemplary embodiments.

[0019] Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to facilitate a comprehensive understanding of the methods, devices, and / or systems described herein. However, these are merely examples and the present invention is not limited thereto.

[0020] In describing embodiments of the present invention, if a detailed description of a known technology related to the present invention is judged to unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the terms described below are terms defined in consideration of their functions in the present invention, and this may vary depending on the intention or custom of the user or operator. Therefore, the definitions should be made based on the contents throughout this specification. The terminology used in the detailed description is only for the purpose of describing embodiments of the present invention and should not be limited in any way. Unless clearly used otherwise, the singular form includes the plural form. In this description, expressions such as "comprises" or "having" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, and should not be construed to exclude the presence or possibility of one or more other features, numbers, steps, operations, elements, parts or combinations thereof other than those described.

[0021] In the following description, the terms "transmission," "communication," "sending," "receiving," and other similar terms for signals or information include not only the direct transmission of signals or information from one component to another, but also transmission via another component. In particular, "transmitting" or "sending" a signal or information to one component indicates the final destination of the signal or information, and does not mean the direct destination. The same applies to "receiving" a signal or information. In addition, in this specification, the "relationship" of two or more pieces of data or information means that when one piece of data (or information) is acquired, at least a portion of the other piece of data (or information) can be acquired based on it.

[0022] Additionally, while terms such as "first" and "second" may be used to describe various components, these components should not be limited by these terms. These terms may be used to distinguish one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a "second component," and similarly, a second component may also be referred to as a "first component."

[0023] FIG. 1 is a diagram illustrating a SBOM (Software Bill Of Materials) management system using blockchain according to one embodiment of the present invention.

[0024] Referring to FIG. 1, the SBOM management system (100) may include a project server (102) and a blockchain network (104). Each project server (102) is communicatively connected to the blockchain network (104) via a communication network (150).

[0025] In one embodiment, the communication network (150) may include the Internet, one or more local area networks, wide area networks, a cellular network, a mobile network, other types of networks, or a combination of these networks.

[0026] The project server (102) may be a server computing device for performing a project based on one or more software including one or more open sources. Here, the software may be a concept including an operating system, middleware, and applications.

[0027] The project server (102) can generate a Software Bill of Materials (SBOM) for each open source included in the software. The SBOM is a software bill of materials and can include metadata representing the components of the software. Items included in the SBOM can include, for example, a supplier name, a component name, a component version string, a component hash, a unique identifier, a dependency relationship, an author name, and a time stamp.

[0028] Here, the provider name can refer to the name of the entity that created and defined the component. The unique identifier can be information that uniquely identifies the component. A dependency relationship can indicate which software the component is included in. The data creator can refer to the name of the entity that created the SBOM data. The timestamp can include the date and time the SBOM data was created.

[0029] In one embodiment, the project server (102) can analyze the code patterns of each open source included in the software and generate an SBOM for the corresponding open source. The project server (102) can generate an SBOM for each open source according to a preset SBOM standard. In this case, the project server (102) can generate an SBOM for each open source using a previously known SBOM creation tool, but is not limited thereto.

[0030] Additionally, the project server (102) can generate vulnerability information for each open source included in the software. In one embodiment, the project server (102) can generate vulnerability information related to security vulnerabilities and exposures for each open source using Common Vulnerabilities and Exposures (CVE). The vulnerability information may include vulnerability content information (information about which security vulnerabilities the corresponding open source has) and vulnerability rating information (information about the vulnerability rating or vulnerability score of the corresponding open source).

[0031] The project server (102) can generate SBOM-related information for each open source included in the software. The SBOM-related information may include SBOM and vulnerability information for the corresponding open source. The project server (102) can transmit an SBOM registration request containing SBOM-related information to the blockchain network (104).

[0032] A blockchain network (104) includes a plurality of nodes (104a). The plurality of nodes (104a) included in the blockchain network (104) can communicate with other nodes (104a). Each node (104a) is configured to process and store arbitrary data, and thus can function as a node constituting the blockchain network (104).

[0033] Node (104a) may be divided into one or more management nodes and multiple general nodes. The management node may be configured to not only function as a general node, but also communicate with the project server (102). The management node may communicate with general nodes. The management node may be configured to perform functions such as receiving requests or inquiries from the project server (102) and responding to them by performing tasks or responding to them. That is, in the disclosed embodiment, the operation of the blockchain network (104) may be performed by the management node.

[0034] When the blockchain network (104) receives an SBOM registration request from the project server (102), it can register SBOM-related information included in the SBOM registration request into the blockchain. The blockchain network (104) can store SBOM-related information in a table format in each node (104a). The blockchain network (104) can extract open source SBOM and vulnerability information from the SBOM-related information.

[0035] The blockchain network (104) can extract each item of the SBOM (supplier name, component name, component version, component hash value, unique identifier, dependency, data creator, and timestamp, etc.) and store it in a table format. At this time, the table may also include vulnerability information of the corresponding open source. In other words, the table may include items regarding the vulnerability content and vulnerability level of the open source. Hereinafter, the table stored in the blockchain network (104) may be referred to as the SBOM blockchain table.

[0036] The blockchain network (104) can extract preset items from the SBOM to generate a first blockchain hash. In one embodiment, the blockchain network (104) can extract the supplier name, component name, and component version from the SBOM, combine them into a single string, and apply a hash function to the combined string to generate the first blockchain hash.

[0037] At this time, if the length of the string combining the supplier name, component name, and component version exceeds a preset threshold length, the blockchain network (104) may generate a string after excluding the item with the lowest priority according to the priority set among the preset items (i.e., the supplier name, the component name, and the component version), and may generate a first blockchain hash through this. The first blockchain hash may be arranged to have a different bit length from the hash value of the component among the items of the SBOM.

[0038] Additionally, the blockchain network (104) can generate a second blockchain hash based on vulnerability information extracted from SBOM-related information. The blockchain network (104) can store the first blockchain hash and the second blockchain hash by matching them with the SBOM blockchain table. That is, each node (104a) of the blockchain network (104) can commonly store the SBOM blockchain table and the first blockchain hash and the second blockchain hash matched therewith.

[0039] Here, when SBOM registration requests are received from multiple project servers (102) and SBOM-related information is stored and registered in the SBOM blockchain table, SBOM-related information for multiple open sources is stored in a table-type blockchain in each node (104a) of the blockchain network (104) and becomes a database.

[0040] Meanwhile, when a project to be performed based on one or more software is given, the project server (102) can check the open sources included in the software and inquire the blockchain network (104) as to whether SBOM-related information of each open source is stored in the blockchain network (104).

[0041] That is, when a project is given, the project server (102) can send an inquiry to the blockchain network (104) as to whether SBOM is stored for each open source of the software, and inquire whether SBOM-related information of each open source is stored in the blockchain network (104). Here, when there are multiple open sources included in the software, the project server (102) can list the open sources and send an inquiry to the blockchain network (104) as to whether SBOM is stored for each open source.

[0042] Then, the blockchain network (104) can transmit a response to the inquiry regarding whether or not to store the SBOM to the corresponding project server (102). The blockchain network (104) can check whether SBOM-related information corresponding to the inquiry regarding whether or not to store the SBOM is stored in the previously stored SBOM blockchain table and transmit the response to the inquiry to the corresponding project server (102).

[0043] The project server (102) can check which open source software has or does not have SBOM-related information stored in the blockchain network (104) through an inquiry response.

[0044] If SBOM-related information is stored in the blockchain network (104) among the open sources of software, the project server (102) can receive and store the SBOM-related information (SBOM and vulnerability information of the open source) from the blockchain network (104). In this case, the project server (102) does not need to separately generate SBOM and vulnerability information for the open source.

[0045] If there is an open source among the open sources of software for which SBOM-related information is not stored in the blockchain network (104), the project server (102) can create SBOM-related information including SBOM and vulnerability information for the open source, and send an SBOM registration request including SBOM-related information to the blockchain network (104) so ​​that the SBOM-related information of the open source is stored in the SBOM blockchain table.

[0046] In addition, the project server (102) may transmit an SBOM verification request to the blockchain network (104) periodically or intermittently when starting to perform a project using the software or while performing the project. That is, the project server (102) may transmit an SBOM verification request to the blockchain network (104) to check whether there is any falsification or alteration of the SBOM-related information of each open source included in the software.

[0047] At this time, the project server (102) can extract preset items from the SBOM items of each open source to generate a first hash value, generate a second hash value based on vulnerability information of the corresponding open source, and then include the first hash value and the second hash value in the SBOM verification request.

[0048] When the blockchain network (104) receives an SBOM verification request from the project server (102), it extracts a first blockchain hash and a second blockchain hash that match the SBOM-related information from the pre-stored SBOM blockchain table, compares the extracted first blockchain hash and the second blockchain hash with the first hash value and the second hash value included in the SBOM verification request, and transmits the SBOM verification result to the project server (102).

[0049] Here, if the first blockchain hash and the second blockchain hash and the first hash value and the second hash value included in the SBOM verification request match, respectively, the blockchain network (104) can conclude that the SBOM-related information has not been falsified. On the other hand, if at least one of the first blockchain hash and the second blockchain hash and the first hash value and the second hash value included in the SBOM verification request does not match, the blockchain network (104) can conclude that the SBOM-related information has been falsified.

[0050] Meanwhile, the blockchain network (104) can store information (project-related information) related to the projects being carried out on each project server (102). At this time, the project-related information can only be stored on the management node of the blockchain network (104). In other words, the project-related information is not stored separately on all nodes in the form of a blockchain, but only on designated management nodes. Project-related information may include the project name, software used to carry out the project, and open source included in the software.

[0051] In response to the SBOM verification request, if the SBOM-related information is found to have been tampered with after confirming whether the SBOM-related information has been tampered with, the blockchain network (104) can extract previously stored project-related information and extract a project server (102) that performs a project corresponding to the SBOM-related information in which tampering has occurred (i.e., a project that uses software including open source corresponding to the SBOM-related information in which tampering has occurred). The blockchain network (104) can send a tampering warning alarm to the extracted project server (102).

[0052] FIG. 2 is a diagram schematically illustrating a state in which a forgery warning alarm is transmitted in an SBOM management system according to an embodiment of the present invention. Referring to FIG. 2, SBOM blockchain tables (SBOM-01, SBOM-02, SBOM-03, SBOM-04, SBOM-05, SBOM-06, SBOM-nn) may be connected to a blockchain and stored in a blockchain network (104). In addition, open sources included in software for a project may be installed in each project server (102). Here, the open source corresponds to SBOM and is expressed as SBOM for convenience of explanation.

[0053] That is, open sources corresponding to SBOM-01, SBOM-02, and SBOM-03 may be installed on the first project server (102-1), open sources corresponding to SBOM-03, SBOM-05, and SBOM-06 may be installed on the second project server (102-2), and open sources corresponding to SBOM-02, SBOM-06, and SBOM-08 may be installed on the third project server (102-3).

[0054] Here, if it is confirmed that SBOM-3 has been tampered with, the blockchain network (104) can confirm that the open source corresponding to SBOM-3 is installed on the first project server (102-1) and the second project server (102-2) through the previously stored project-related information. The blockchain network (104) can transmit a tampering warning alarm for the open source corresponding to SBOM-3 to the first project server (102-1) and the second project server (102-2).

[0055] The blockchain network (104) can calculate the project usage of each open source by monitoring the number of times (number of uses) and frequency of use of the open sources corresponding to the previously stored SBOM blockchain table on the project servers (102). In other words, the degree to which the open sources stored in the SBOM blockchain table are used in the projects of the project servers (102) can be calculated.

[0056] If the project usage of an open source exceeds a preset threshold, the blockchain network (104) can send a message to the project servers (102) using the open source, requesting an SBOM verification request for the open source. Then, each project server (102) using the open source can extract preset items from the items of the SBOM of the open source to generate a first hash value, generate a second hash value based on vulnerability information of the open source, and then send an SBOM verification request including the first hash value and the second hash value to the blockchain network (104).

[0057] In this regard, the blockchain network (104) can extract the first blockchain hash and the second blockchain hash that match the SBOM-related information from the pre-stored SBOM blockchain table, and compare the extracted first blockchain hash and the second blockchain hash with the first hash value and the second hash value included in the SBOM verification request, respectively, to produce the SBOM verification result. In this way, when the usage of an open source project exceeds a preset threshold, the SBOM verification of the open source can be performed more actively and proactively to perform integrity management.

[0058] According to the disclosed embodiment, when conducting a project based on software that includes one or more open source software, the integrity of the SBOM-related information regarding the open source software can be preserved by storing and managing it via blockchain. This allows for easy identification and action to be taken in the event of falsification or alteration of the SBOM-related information. Furthermore, each project server can use the SBOM-related information to identify vulnerabilities in the corresponding open source software and reliably address them.

[0059] Figure 3 is a flowchart illustrating a blockchain-based SBOM management method according to one embodiment of the present invention. While the illustrated flowchart divides the method into multiple steps, at least some of the steps may be performed in a different order, combined with other steps, omitted, divided into substeps, or performed with one or more additional steps not shown.

[0060] Referring to FIG. 3, the project server (102) can generate SBOM-related information including SBOM and vulnerability information for each open source included in the software and transmit an SBOM registration request to the blockchain network (104) (S 101). Next, the blockchain network (104) can extract each item from the SBOM and vulnerability information of the SBOM-related information and generate an SBOM blockchain table (S 103).

[0061] Next, the blockchain network (104) can extract preset items from the SBOM to generate a first blockchain hash and generate a second blockchain hash based on vulnerability information (S 105). Next, the blockchain network (104) can match the first blockchain hash and the second blockchain hash with the SBOM blockchain table and store them (S 107).

[0062] FIG. 4 is a block diagram illustrating a computing environment (10) including a computing device suitable for use in exemplary embodiments. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

[0063] The illustrated computing environment (10) includes a computing device (12). In one embodiment, the computing device (12) may be a project server (102). Additionally, the computing device (12) may be a node (104a) constituting a blockchain network (104).

[0064] A computing device (12) includes at least one processor (14), a computer-readable storage medium (16), and a communication bus (18). The processor (14) may cause the computing device (12) to operate according to the exemplary embodiments mentioned above. For example, the processor (14) may execute one or more programs stored in the computer-readable storage medium (16). The one or more programs may include one or more computer-executable instructions, which, when executed by the processor (14), may be configured to cause the computing device (12) to perform operations according to the exemplary embodiments.

[0065] A computer-readable storage medium (16) is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. A program (20) stored in the computer-readable storage medium (16) includes a set of instructions executable by the processor (14). In one embodiment, the computer-readable storage medium (16) may be a memory (volatile memory such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, any other form of storage medium that can be accessed by the computing device (12) and store desired information, or a suitable combination thereof.

[0066] A communication bus (18) interconnects various other components of the computing device (12), including the processor (14) and computer-readable storage media (16).

[0067] The computing device (12) may also include one or more input / output interfaces (22) that provide interfaces for one or more input / output devices (24) and one or more network communication interfaces (26). The input / output interfaces (22) and the network communication interfaces (26) are connected to the communication bus (18). The input / output devices (24) may be connected to other components of the computing device (12) via the input / output interfaces (22). Exemplary input / output devices (24) may include input devices such as pointing devices (such as a mouse or a trackpad), a keyboard, a touch input device (such as a touchpad or a touchscreen), a voice or sound input device, various types of sensor devices and / or photographing devices, and / or output devices such as display devices, printers, speakers and / or network cards. The exemplary input / output devices (24) may be included within the computing device (12) as a component constituting the computing device (12), or may be connected to the computing device (12) as a separate device distinct from the computing device (12).

[0068] While representative embodiments of the present invention have been described in detail above, those skilled in the art will appreciate that various modifications to the above-described embodiments are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims set forth below but also by equivalents thereof.

Claims

1. One or more project servers that perform a project based on one or more software including one or more open sources, generate a Software Bill Of Materials (SBOM) and SBOM-related information including vulnerability information for each open source included in the software, and transmit an SBOM registration request including the SBOM-related information; and A blockchain network comprising a plurality of nodes, which receives the SBOM registration request, creates an SBOM blockchain table based on the SBOM-related information, and stores the created SBOM blockchain table in each of the plurality of nodes, The items included in the above SBOM include one or more of the supplier name, component name, component version string, component hash, unique identifier, relationship, author name, and time stamp. The above vulnerability information includes at least one of vulnerability content information and vulnerability level information. The above blockchain network is, An SBOM management system that extracts each item from the SBOM of the SBOM-related information, extracts each item from vulnerability information of the SBOM-related information, creates an SBOM blockchain table composed of the extracted items, extracts preset items from the SBOM to create a first blockchain hash, creates a second blockchain hash based on the vulnerability information, and stores the first blockchain hash and the second blockchain hash by matching them with the SBOM blockchain table.

2. In claim 1, The above blockchain network is, Extract the supplier name, component name, and component version from the above SBOM, collate them into a single string, and apply a hash function to the collated string to generate a first blockchain hash. An SBOM management system in which the first blockchain hash is provided to have a bit length different from the hash value of a component among the items of the SBOM.

3. In claim 2, The above blockchain network is, An SBOM management system that generates a first blockchain hash by excluding the lowest priority item according to the priority set among the items when the length of the string combining the above supplier name, component name, and component version exceeds a preset threshold length.

4. In claim 1, The project server is, When a project to be performed based on one or more software is given, each open source included in the software is checked, and an inquiry regarding whether SBOM is stored for each open source is sent to the blockchain network. The above blockchain network is, An SBOM management system that checks whether SBOM-related information corresponding to an inquiry about whether to store the SBOM is stored in the SBOM blockchain table and transmits an inquiry response to the corresponding project server.

5. In claim 4, The above project server is, When receiving the above inquiry response, if SBOM-related information among the open sources of the software is stored in the blockchain network based on the above inquiry response, SBOM-related information of the open source is received from the blockchain network and stored, An SBOM management system that generates SBOM-related information including SBOM and vulnerability information for the open source software when SBOM-related information among the open sources of the software is not stored in the blockchain network, and transmits an SBOM registration request including the generated SBOM-related information to the blockchain network.

6. In claim 5, The above project server is, When starting or during the execution of the above project, a SBOM verification request is sent to the above blockchain network. An SBOM management system that extracts preset items from the SBOM items of the open source included in the above software to generate a first hash value, generates a second hash value based on vulnerability information of the open source, and includes the first hash value and the second hash value in the SBOM verification request.

7. In claim 6, The above blockchain network is, An SBOM management system that, when receiving the above SBOM verification request, extracts a first blockchain hash and a second blockchain hash that match the corresponding SBOM-related information from the SBOM blockchain table, compares the extracted first blockchain hash and second blockchain hash with the first hash value and the second hash value included in the SBOM verification request, and transmits the SBOM verification result to the corresponding project server.

8. In claim 7, The above blockchain network stores project-related information (including project name, software used to perform the project, and information about open sources included in the software) related to the project being performed on each project server. The above blockchain network is, An SBOM management system that extracts project-related information when, as a result of the SBOM verification, falsification occurs in SBOM-related information, extracts a project server in which an open source corresponding to the SBOM-related information in which falsification has occurred based on the project-related information, and sends a falsification warning alarm for the open source to the extracted project server.

9. In claim 8, The above blockchain network is, An SBOM management system that calculates project usage based on at least one of the number of times and frequency of use on project servers for each open source corresponding to the SBOM blockchain table, and, when the project usage of the open source exceeds a preset threshold, sends a message to the project server using the open source to request an SBOM verification for the open source.

10. In a project server that performs a project based on one or more software including one or more open sources, a step of generating a Software Bill Of Materials (SBOM) and SBOM-related information including vulnerability information for each open source included in the software, and transmitting an SBOM registration request including the SBOM-related information; and In a blockchain network consisting of a plurality of nodes, a step of receiving the SBOM registration request, generating an SBOM blockchain table based on the SBOM-related information, and storing the generated SBOM blockchain table in each of the plurality of nodes is included. The items included in the above SBOM include one or more of the supplier name, component name, component version string, component hash, unique identifier, relationship, author name, and time stamp. The above vulnerability information includes at least one of vulnerability content information and vulnerability level information. The above saving step is, An SBOM management method, wherein, in the blockchain network, each item of the SBOM-related information is extracted from the SBOM, each item is extracted from vulnerability information of the SBOM-related information, and an SBOM blockchain table is created by extracting the extracted items, extracting preset items from the SBOM to create a first blockchain hash, creating a second blockchain hash based on the vulnerability information, and storing the first blockchain hash and the second blockchain hash by matching them with the SBOM blockchain table.

Images