SBOM fragmentation transmission method, apparatus, device, medium and product

Abstract

This invention provides a method, apparatus, device, medium, and product for SBOM fragmented transmission, relating to the field of data transmission technology, to address the shortcomings of poor reliability and semantic integrity in SBOM transmission, and to improve the reliability and semantic integrity of SBOM transmission. The method includes: a data sending end converting SBOM data into a Directed Acyclic Graph (DAG); based on the dependencies between the DAG and multiple components, dividing the SBOM data into multiple data fragments, each data fragment including at least one component; determining fragmentation information for each data fragment; and finally sending the multiple data fragments and the fragmentation information of each data fragment to a data receiving end; the data receiving end storing the data fragments based on the fragmentation information of each data fragment and performing integrity verification; and, if the integrity verification passes, reassembling the multiple data fragments to obtain the SBOM data.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a method, apparatus, device, medium, and product for SBOM fragmented transmission. Background Technology

[0002] The Software Bill of Materials (SBOM), a key representation of Software Composition Analysis (SCA), describes all components of an application, their dependencies, and the open-source licenses they use. The SBOM serves as the data foundation for vulnerability impact analysis, risk attribution, and compliance audits.

[0003] In practice, SBOMs are often generated on the endpoint (e.g., Windows / Linux hosts, container nodes) and transmitted to the security management platform (receiving end) via message brokers for unified processing and analysis. Currently, when dealing with massive SBOMs containing tens of thousands to hundreds of thousands of components, a message body fragmentation strategy based on a fixed number of bytes (e.g., each fragment is 1MB) is used, and then the message body is reassembled based on the fragment sequence number. However, the reliability and semantic integrity of SBOM transmission are poor, which affects the correctness and effectiveness of vulnerability impact analysis and risk tracing analysis results in the security management platform. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for SBOM fragmentation transmission, which addresses the shortcomings of poor reliability and semantic integrity in existing SBOM transmission technologies, thereby improving the reliability and semantic integrity of SBOM transmission and enhancing the correctness and effectiveness of vulnerability impact analysis and risk tracing analysis results in security management platforms.

[0005] This invention provides an SBOM fragmentation transmission method, applied to the data sending end, comprising the following steps.

[0006] Convert the software bill of materials (SBOM) data into a directed acyclic graph (DAG). The SBOM data includes multiple components with dependencies between them. Based on the DAG and the dependencies between multiple components, the SBOM data is divided into multiple data shards. Each data shard includes at least one component, and the at least one component included in each data shard has complete dependencies between them. Determine the fragment information for each data fragment among multiple data fragments. The fragment information includes at least one of the following: fragment identifier, checksum, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. Multiple data shards, along with the shard information for each data shard, are sent to the data receiving end.

[0007] According to the present invention, a method for fragmented transmission of a software bill of materials (SBOM) data is provided, which converts SBOM data into a directed acyclic graph (DAG), including: Read SBOM data from the message queue, traverse and parse the SBOM data to determine the dependencies between multiple components; Based on the dependencies between multiple components, convert SBOM data into DAG; The DAG consists of multiple nodes and multiple directed edges. Each node corresponds to a component, and the node represents the component's attribute information, which includes at least one of the following: component identifier, component version number, parent node pointer, and child node pointer set. Each directed edge represents the dependency relationship between the corresponding two components.

[0008] According to the present invention, an SBOM fragmentation transmission method is provided, which divides SBOM data into multiple data fragments based on the DAG and the dependencies between multiple components, including: Based on the DAG, the dependencies between multiple components are scanned to identify multiple component sets. Each component set includes at least one component, and the at least one component in each component set has complete dependencies between them. Multiple data shards are obtained based on multiple component sets. Each data shard includes at least one component set, and the amount of data included in a data shard is less than or equal to a preset amount of data.

[0009] According to the SBOM fragmentation transmission method provided by the present invention, determining the fragmentation information of each data fragment in a plurality of data fragments includes: Generate a shard identifier for each of the multiple data shards. The shard identifier is determined based on the hash value corresponding to the sequence of components included in each data shard. The cyclic redundancy check value of the components included in each data shard is determined as the checksum; Generate a completion identifier field for each data shard. The completion identifier field is either the first field or the second field. The first field indicates that the data shard is not the last data shard of the SBOM data, and the second field indicates that the data shard is the last data shard of the SBOM data.

[0010] This invention provides an SBOM fragmentation transmission method, applied at a data receiving end, comprising the following steps.

[0011] The system receives multiple data fragments and fragment information for each data fragment sent by the data sender. The multiple data fragments are obtained by dividing the SBOM data. Each data fragment includes at least one component, and the at least one component included in each data fragment has a complete dependency relationship. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. Based on the sharding information of each data shard, each data shard is stored in a sharding hash table, and integrity verification is performed on multiple data shards. If multiple data shards pass integrity verification, the multiple data shards are reassembled to obtain SBOM data.

[0012] According to the SBOM fragmentation transmission method provided by the present invention, integrity verification is performed on multiple data fragments, including: Determine whether the number of received data fragments matches the total number of fragments, and whether the completion identifier field of one of the data fragments is the second field, where the second field indicates that the data fragment is the last data fragment of the SBOM data; Determine whether the cyclic redundancy check value and check code of the components included in each data shard are consistent; Determine whether the components included in each data shard are in the same data shard as their parent nodes.

[0013] The present invention also provides an SBOM fragmentation transmission device, applied at a data sending end, comprising the following modules: a data conversion module, a data fragmentation module, a data verification module, and a data sending module; The data conversion module is used to convert software bill of materials (SBOM) data into a directed acyclic graph (DAG). The SBOM data includes multiple components with dependencies between them. The data sharding module is used to divide SBOM data into multiple data shards based on DAG and the dependencies between multiple components. Each data shard includes at least one component, and the at least one component included in each data shard has complete dependencies between each other. The data verification module is used to determine the fragment information of each data fragment among multiple data fragments. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The data sending module is used to send multiple data fragments, along with fragment information for each data fragment, to the data receiving end.

[0014] According to the present invention, an SBOM fragmentation transmission device includes a data conversion module, which is specifically used for: Read SBOM data from the message queue, traverse and parse the SBOM data to determine the dependencies between multiple components; Based on the dependencies between multiple components, convert SBOM data into DAG; The DAG consists of multiple nodes and multiple directed edges. Each node corresponds to a component, and the node represents the component's attribute information, which includes at least one of the following: component identifier, component version number, parent node pointer, and child node pointer set. Each directed edge represents the dependency relationship between the corresponding two components.

[0015] According to the present invention, an SBOM fragmentation transmission device, specifically a data fragmentation module, is used for: Based on the DAG, the dependencies between multiple components are scanned to identify multiple component sets. Each component set includes at least one component, and the at least one component in each component set has complete dependencies between them. Multiple data shards are obtained based on multiple component sets. Each data shard includes at least one component set, and the amount of data included in a data shard is less than or equal to a preset amount of data.

[0016] According to the present invention, an SBOM fragmentation transmission device includes a data verification module, which is specifically used for: Generate a shard identifier for each of the multiple data shards. The shard identifier is determined based on the hash value corresponding to the sequence of components included in each data shard. The cyclic redundancy check value of the components included in each data shard is determined as the checksum; Generate a completion identifier field for each data shard. The completion identifier field is either the first field or the second field. The first field indicates that the data shard is not the last data shard of the SBOM data, and the second field indicates that the data shard is the last data shard of the SBOM data.

[0017] The present invention also provides an SBOM fragmentation transmission device, applied at a data receiving end, comprising the following modules: a data receiving module, a data storage module, and a data reassembly module; The data receiving module is used to receive multiple data fragments and fragment information of each data fragment sent by the data sending end. The multiple data fragments are obtained by dividing the SBOM data. Each data fragment includes at least one component. The at least one component included in each data fragment has a complete dependency relationship. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The data storage module is used to store each data shard in a shard hash table based on the shard information of each data shard, and to perform integrity verification on multiple data shards; The data reassembly module is used to reassemble multiple data shards to obtain SBOM data after multiple data shards have passed integrity verification.

[0018] According to the present invention, an SBOM fragmentation transmission device and a data storage module are specifically used for: Determine whether the number of received data fragments matches the total number of fragments, and whether the completion identifier field of one of the data fragments is the second field, where the second field indicates that the data fragment is the last data fragment of the SBOM data; Determine whether the cyclic redundancy check value and check code of the components included in each data shard are consistent; Determine whether the components included in each data shard are in the same data shard as their parent nodes.

[0019] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the SBOM fragmentation transmission methods described above.

[0020] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the SBOM fragmentation transmission methods described above.

[0021] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the SBOM fragmentation transmission methods described above.

[0022] This invention provides a method, apparatus, device, medium, and product for transmitting SBOM fragmented data. By converting SBOM data, which includes multiple components, into a Directed Acyclic Graph (DAG), the dependencies between the components can be represented by the DAG. Based on the DAG and the dependencies between the components, the SBOM data is divided into multiple data fragments, and each data fragment includes at least one component with a complete dependency relationship. This ensures that components with dependencies are grouped into the same data fragment. The fragmentation information of each data fragment is then determined, and the multiple data fragments, along with their fragmentation information, are sent to a data receiving end. Upon receiving the multiple data fragments, the data receiving end can perform integrity verification based on the fragmentation information of each data fragment. Only when the multiple data fragments pass integrity verification are they reassembled to obtain the SBOM data. Therefore, by ensuring that at least one component in each data fragment has a complete dependency relationship when partitioning data fragments, and by grouping dependent components into a single data fragment, the semantic integrity of the SBOM data can be avoided during data fragment transmission. Furthermore, by verifying the integrity of each data fragment through its fragmentation information, the reliability and semantic integrity of the SBOM data obtained after reassembly at the data receiving end can be guaranteed. This, in turn, improves the correctness and effectiveness of vulnerability impact analysis and risk tracing analysis results in the security management platform. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is one of the flowcharts of the SBOM fragmentation transmission method provided by the present invention.

[0025] Figure 2 This is the second flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0026] Figure 3 This is the third flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0027] Figure 4 This is the fourth flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0028] Figure 5 This is the fifth flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0029] Figure 6 This is the sixth flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0030] Figure 7 This is the seventh flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0031] Figure 8 This is the eighth flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0032] Figure 9 This is the ninth flowchart of the SBOM fragmentation transmission method provided by the present invention.

[0033] Figure 10 This is one of the structural schematic diagrams of the SBOM fragmentation transmission device provided by the present invention.

[0034] Figure 11 This is the second schematic diagram of the SBOM fragmentation transmission device provided by the present invention.

[0035] Figure 12 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0037] Currently, most common SBOM transmission schemes, when dealing with massive SBOMs containing tens of thousands to hundreds of thousands of components, adopt a message body fragmentation strategy based on a fixed number of bytes (e.g., each fragment is 1MB), and then reassemble the message body based on the fragment sequence number. While this fixed-byte fragmentation scheme is simple and feasible, it ignores the inherent semantics of component dependencies within the SBOM itself, often leading to the disruption of dependencies between components during the fragmentation and reassembly process.

[0038] Therefore, existing SBOM fragmentation transmission technologies have the following main problems: First, byte-level fragmentation destroys semantic integrity. In actual engineering implementations, fixed-byte fragmentation is often used. For example, in a parent-child dependency relationship of components "openssl→libssl→zlib", using a byte-level fragmentation scheme, the parent and child components may be assigned to different fragments (e.g., openssl in fragment 1, but libssl in fragment 2), thus destroying the semantic integrity of the SBOM. In this case, if the receiver receives incomplete fragments or errors occur in fragment reassembly, it is impossible to recover the complete dependency relationship. Second, fragment reassembly lacks a dependency verification mechanism. Existing sequence number-based fragment reassembly methods only identify fragments and reassemble them using sequence numbers, without verifying whether the dependencies between components are complete. In this fragmentation scheme, if fragments are lost, misplaced, or damaged, the reassembled SBOM will produce "orphaned nodes" that are detached from the dependencies, causing the dependency resolution program to crash. Third, the transmission completion flag is susceptible to network jitter. Current mainstream fragmentation transmission schemes mainly use the completion flag bit on the fragment to indicate the end of transmission. In networks with high latency, if this flag bit on a fragment arrives before other fragments, the receiver may mistakenly believe that transmission is complete, resulting in the loss of part of the SBOM.

[0039] Therefore, there is an urgent need for a solution that can ensure the semantic integrity and reassembly reliability of SBOM in cross-platform system environments (such as Windows / Linux) under conditions such as large SBOM data volume, strong interdependence between components, and poor network conditions.

[0040] The basic idea behind the SBOM fragmentation transmission method provided in this application is to abandon the traditional method of using "bytes" as the fragmentation unit and instead adopt "semantically complete component dependency subgraphs" as the fragmentation unit. This transforms the SBOM fragmentation problem from a traditional byte-based data splitting problem into a component subgraph construction problem based on dependency constraints. Simultaneously, while satisfying the semantic integrity of component dependencies, it dynamically constructs and partitions the component set in conjunction with fragment size constraints to improve overall transmission efficiency and fragment utilization. This method is suitable for SBOM data transmission scenarios in hybrid IT environments using message middleware such as Kafka and RabbitMQ.

[0041] The following is combined with Figures 1 to 12 This invention describes the SBOM fragmentation transmission method, apparatus, equipment, medium, and product provided by the present invention.

[0042] Figure 1 This is one of the flowcharts illustrating the SBOM fragmented transmission method provided by the present invention, applied to the data sending end, such as... Figure 1As shown, the method includes the following: Step 101: The data sending end converts the software bill of materials (SBOM) data into a directed acyclic graph (DAG).

[0043] The SBOM data includes multiple components, and there are dependencies between these components.

[0044] Step 102: The data sending end divides the SBOM data into multiple data fragments based on the DAG and the dependencies between multiple components.

[0045] Each of the multiple data shards includes at least one component, and the at least one component included in each data shard has a complete dependency relationship with each other.

[0046] Step 103: The data sending end determines the fragmentation information of each data fragment among multiple data fragments.

[0047] The sharding information includes at least one of the following: shard identifier, checksum, completion identifier field, and total number of shards. The completion identifier field is used to indicate whether the data shard is the last data shard of the SBOM data.

[0048] Step 104: The data sending end sends multiple data fragments, along with the fragmentation information of each data fragment, to the data receiving end.

[0049] In one possible implementation, Figure 2 This is the second flowchart illustrating the SBOM fragmentation transmission method provided by the present invention, as shown below. Figure 2 As shown, the SBOM fragmentation transmission method can be applied to the SBOM fragmentation transmission system, which includes a four-layer architecture: dependency tree resolution layer, fragmentation cutting layer, semantic verification layer, and reassembly verification layer.

[0050] Specifically, using the original SBOM message queue as the data input source, a four-layer core architecture is employed to construct and output a complete SBOM dependency tree. After retrieving SBOM data from the original SBOM message queue, the dependency tree parsing layer receives the original SBOM data, parses it, and outputs a Directed Acyclic Graph (DAG) with an adjacency list structure. Cross-platform support is provided through the Windows / Linux cross-platform adaptation component. Further, the sharding layer shards the DAG based on the complete subgraph, outputting shards based on the complete subgraph. The semantic validation layer performs semantic validation on the data shards, generating shards with validation information and sending them to external message middleware such as Kafka / RabbitMQ. The reassembly and verification layer receives the shards transmitted by the message middleware, completes the reassembly and verification, and finally outputs an SBOM dependency tree with complete semantics for subsequent security analysis, forming a complete SBOM processing chain.

[0051] This invention provides a method for transmitting SBOM fragments. By converting SBOM data, which includes multiple components, into a Directed Acyclic Graph (DAG), the dependencies between these components can be represented by the DAG. Based on the DAG and these dependencies, the SBOM data is divided into multiple data fragments, with each data fragment containing at least one component that has a complete dependency relationship. This ensures that components with dependencies are grouped into the same data fragment. The fragmentation information for each data fragment is then determined, and the multiple data fragments, along with their fragmentation information, are sent to a data receiving end. Upon receiving the multiple data fragments, the data receiving end can perform integrity verification based on the fragmentation information of each fragment. Only after multiple data fragments pass integrity verification are they reassembled to obtain the SBOM data. Thus, by ensuring that each data fragment contains at least one component with a complete dependency relationship and grouping dependent components into a single data fragment, the semantic integrity of the SBOM data can be avoided during data fragment transmission. By verifying the integrity of each data fragment through its fragmentation information, the reliability and semantic integrity of the SBOM data obtained after reassembly at the data receiving end can be guaranteed. This, in turn, improves the correctness and effectiveness of vulnerability impact analysis and risk tracing analysis results in the security management platform.

[0052] Figure 3 This is the third flowchart of the SBOM fragmented transmission method provided by the present invention, applied to the data sending end, such as... Figure 3 As shown, "the data sending end converts the software bill of materials (SBOM) data into a directed acyclic graph (DAG)" includes the following: Step 301: The data sending end reads SBOM data from the message queue and traverses and parses the SBOM data to determine the dependencies between multiple components.

[0053] Step 302: The data sending end converts the SBOM data into a DAG based on the dependencies between multiple components.

[0054] The DAG consists of multiple nodes and multiple directed edges. Each node corresponds to a component, and the node represents the component's attribute information, which includes at least one of the following: component identifier, component version number, parent node pointer, and child node pointer set. Each directed edge represents the dependency relationship between the corresponding two components.

[0055] In one possible implementation, a dependency tree resolution layer can be used to perform structured parsing of the original SBOM data. This forms the basis for subsequent sharding and maintaining semantic integrity. The SBOM data here typically uses a structured format such as JSON to describe multiple components and their dependencies.

[0056] Specifically, the dependency tree parsing layer reads SBOM data from the message queue, performs traversal and parsing operations, converts the data into a directed acyclic graph (DAG) in the form of an adjacency list, and outputs it. The file reading module reads the SBOM data file and loads it into a memory buffer. The dependency tree analysis module abstracts each software component as a node and establishes directed associations between nodes based on the dependencies between components, thereby generating a DAG representing the component dependencies. Directed edges represent the dependency relationships between components and their dependent components. Through these processes, a DAG in the form of an adjacency list is obtained, with components as nodes and dependencies as edges, providing the basic data structure for subsequent dependency integrity analysis and fragmentation unit partitioning.

[0057] In one possible implementation, within a Directed Acyclic Graph (DAG), each node corresponds to a component. Each node should include the following attributes: component ID, component version, parent node pointer, and a set of child node pointers. The component ID is a unique identifier for the component. The parent node pointer points to the upstream components that the current component depends on, and the set of child node pointers points to the set of downstream components that depend on the current component. Furthermore, each directed edge represents a dependency relationship between components.

[0058] Specifically, in the process of modeling SBOM data as a DAG, the SBOM is first abstracted into a directed acyclic graph. Where V represents the set of all components, E represents the set of dependencies between components, and v and u represent any distinct components in set V. This indicates that component v depends on component u, and G represents the overall structure of all components and their dependencies in the entire SBOM data.

[0059] Furthermore, a component size function can be defined. ,in This represents the serialized byte size of any component v in the component set V, in bytes, and is a positive integer. It also defines dependencies. , This represents the set of all upstream components that component v directly depends on.

[0060] In this embodiment, by traversing and parsing the read SBOM data, the dependencies between multiple components included in the SBOM data can be determined. Based on these dependencies, the SBOM data can then be converted into a Directed Acyclic Graph (DAG). Thus, when partitioning the SBOM data into multiple data fragments, the dependencies between components represented by the DAG can be accurately partitioned, avoiding the misplacement of dependent components into different data fragments and the disruption of these dependencies. This ensures the reliability of data transmission and the integrity of the data during reassembly.

[0061] Figure 4 This is the fourth flowchart of the SBOM fragmented transmission method provided by the present invention, applied to the data sending end, such as... Figure 4 As shown, "the data sending end divides the SBOM data into multiple data fragments based on the DAG and the dependencies between multiple components," including the following: Step 401: The data sending end scans the dependencies between multiple components based on the DAG to determine the set of multiple components.

[0062] Each of the multiple component sets includes at least one component, and the at least one component in each component set has a complete dependency relationship with each other.

[0063] Step 402: The data sending end obtains multiple data fragments based on multiple component sets.

[0064] A data shard includes at least one set of components, and the amount of data included in a data shard is less than or equal to a preset amount of data.

[0065] In one possible implementation, the core functional layer of this invention is to perform sharding of the SBOM data while ensuring the semantic integrity of component dependencies through a sharding layer. Within the sharding layer, the system scans the component dependencies based on the directed acyclic graph generated by the dependency tree parsing layer, gradually constructing a set of components that satisfy the integrity of the dependencies. This set of components is defined as a complete subgraph, which serves as the basic data unit for sharding. The pseudocode for the complete subgraph construction logic is illustrated below: function buildCompleteSubgraph(leafNode, threshold): C = empty set stack = [leafNode] while stack is not empty: node = stack.pop() if node in C: continue C.add(node) for parent in node.parents: # Includes direct and indirect dependencies stack.push(parent) if sum( (v) for v in C)>threshold: C.remove(node) # Dynamic truncation break return C Furthermore, it supports the repeated existence of common dependency nodes in multiple data shards to ensure dependency integrity within each data shard.

[0066] Specifically, during the construction of the complete subgraph and data sharding, the sharding engine first initializes relevant parameters such as the sharding size threshold T (i.e., the preset data volume). Then, based on a reverse dependency-driven traversal strategy, it uses Depth-First-Search (DFS) to backtrack along the dependencies from the leaf nodes, gradually constructing a set of components that satisfy the semantic integrity of the dependencies. The component subset C is defined as the complete subgraph, which must satisfy dependency integrity constraints. If any component v belongs to a component subset C, then the set of upstream components that component v directly depends on is... All components are fully contained within the subset C of components; that is, the direct dependencies of any component in the complete subgraph must be contained within the subgraph. Furthermore, the complete subgraph satisfies the condition that it is closed in terms of dependencies on its internal nodes and does not depend on any nodes outside the subgraph.

[0067] Furthermore, to facilitate engineering implementation, the system uses a recursive backtracking approach during the construction process to gradually incorporate all direct or indirect upstream dependencies of the current component into the candidate set, thereby ensuring that the constructed subgraph satisfies dependency integrity constraints.

[0068] During the sharding process, the sharding engine employs a candidate subgraph-driven incremental merging strategy. It sequentially attempts to deduplicate multiple candidate subgraphs and add them to the current data shard, dynamically accumulating the data size corresponding to the current data shard. That is, data sharding S i The size is equal to the sum of the sizes of all components v in the candidate subgraph contained in the partition.

[0069] When a new candidate subgraph (i.e., a complete subgraph) is detected, the current data partition S will be affected.i When the data size exceeds the preset partition size threshold T, it will cause... When this happens, the system immediately triggers a dynamic truncation mechanism, encapsulating the set of candidate subgraphs that have not yet been added to the new candidate subgraph into a complete data unit (i.e., a data fragment S). i ), and start a new data shard S i+1 The system follows a redundancy dependency strategy. When there are common dependency nodes among multiple complete subgraphs, these nodes are allowed to exist redundantly in multiple shards to ensure that each shard satisfies dependency integrity constraints and semantic integrity.

[0070] In one possible implementation, to ensure the correctness and integrity of the data sharding results globally, the following global constraints are further defined.

[0071] Global coverage constraints This is to ensure that the SBOM is complete. Among them, It is the final generated set of data shards, and V is the collection of all components in the SBOM. This means that the union of the sets of components in all shards is equal to the set of all components in the system, that is, any component must appear in at least one data shard.

[0072] Fragmentation Dependency Integrity Constraints This indicates that for any data fragment in the system... And any component v in that shard, and the set of all directly dependent components of v. All must be completely contained within the same fragment. In this context, the dependencies within each data shard are complete.

[0073] Segmentation size constraints , representing any fragment The size is equal to the sum of the sizes of all components v within that fragment, and any fragment... The size must be less than or equal to the pre-set maximum threshold T, meaning that the size of each data fragment cannot exceed the size threshold limit.

[0074] The above constraint system ensures that the fragmentation results not only satisfy the integrity of dependencies locally, but also maintain the integrity of component coverage globally, thereby guaranteeing the correctness of SBOM during fragmentation transmission and reassembly.

[0075] In addition, during the sharding process, the system locks the currently processed node and its related dependent nodes to prevent the upstream scanning module from modifying or adjusting the dependencies at the same time.

[0076] In this embodiment, since a Directed Acyclic Graph (DAG) represents the dependencies between multiple components, components with complete dependencies can be grouped into the same component set based on the DAG. Furthermore, based on the resulting multiple component sets, the SBOM data can be divided into corresponding data fragments. Thus, when partitioning the SBOM data, the dependencies between components represented by the DAG can be accurately partitioned, avoiding disruption of these dependencies.

[0077] Figure 5 This is the fifth flowchart of the SBOM fragmented transmission method provided by the present invention, applied to the data sending end, such as... Figure 5 As shown, "the data sender determines the fragmentation information of each data fragment among multiple data fragments" includes the following: Step 501: The data sending end generates a fragment identifier for each data fragment in the multiple data fragments.

[0078] The shard identifier is determined based on the hash value corresponding to the sequence of components included in each data shard.

[0079] Step 502: The data sending end determines the cyclic redundancy check value of the components included in each data fragment as the check code.

[0080] Step 503: The data sending end generates a completion identifier field for each data fragment.

[0081] The completion identifier field is either the first field or the second field. The first field indicates that the data fragment is not the last data fragment of the SBOM data, and the second field indicates that the data fragment is the last data fragment of the SBOM data.

[0082] In one possible implementation, a semantic verification layer provides unique identifiers and integrity verification information for data fragments, thereby supporting the data receiving end in carrying out reliable reassembly and anomaly detection.

[0083] Specifically, in the semantic verification layer, the following processing operations can be performed for each generated data fragment: A unique fragment identifier (fragment ID) is generated for each data fragment. The fragment ID is obtained by hashing the normalized sequence of the component set within the data fragment (sorted by componentID); a CRC32 checksum is calculated for the data content within the data fragment to detect whether data corruption has occurred during transmission; a completion flag field (isCompleted) is set for the data fragment, where the completion flag field for non-last data fragments is set to false (i.e., the first field), and the completion flag field for the last data fragment is set to true (i.e., the second field), indicating the end status of the current SBOM fragment transmission sequence.

[0084] Thus, through the setting of the above semantic verification information, each data fragment now not only has information related to data integrity verification, but also carries a clear transmission status, providing a supporting foundation for accurate judgment in subsequent out-of-order data fragment reception scenarios.

[0085] For example, Figure 6 This is the sixth flowchart of the SBOM fragmentation transmission method provided by the present invention, as shown below. Figure 6 As shown, the SBOM data processing flow is implemented through three core steps.

[0086] Step 1: SBOM Input and Parsing. First, the SBOM file is loaded via memory access (file loading). Then, the dependency tree is parsed, a DAG with an adjacency list structure is constructed, and finally, a component adjacency list is generated as the parsing result.

[0087] Step 2: Complete Subgraph Construction and Sharding. First, initialize parameters such as threshold and cumulative size. Then, traverse the component adjacency list backward from the leaf nodes. During the traversal, protect the parent-child relationship through a cross-platform lock to prevent concurrent modifications. When the cumulative size is greater than or equal to the threshold, dynamically truncate and encapsulate the complete subgraph whose cumulative size does not exceed the threshold as a shard.

[0088] Step 3: Semantic checksum generation. Calculate the fragment ID for the fragment, generate a CRC32 checksum, insert a JSON metadata header, and finally output the fragment with checksum information to complete the entire processing flow.

[0089] In this embodiment, based on the hash values ​​corresponding to the sequence of components included in each data shard, a unique shard identifier can be generated for each data shard. The cyclic redundancy check value of the components included in each data shard is used as a checksum, and a completion identifier field is generated for each data shard to indicate whether the data shard is the last data shard of the SBOM data. Thus, by using the shard identifier, checksum, and completion identifier field as the shard information, the receiving end can accurately perform row-level verification of the data shards based on the shard information after receiving them, thereby ensuring data integrity.

[0090] Figure 7 This is the seventh flowchart of the SBOM fragmented transmission method provided by the present invention, applied to the data receiving end, such as... Figure 7 As shown, the method includes the following: Step 701: The data receiver receives multiple data fragments and fragment information of each data fragment sent by the data sender.

[0091] The multiple data shards are obtained by dividing the SBOM data. Each data shard includes at least one component, and the at least one component in each data shard has a complete dependency relationship. The shard information includes at least one of the following: shard identifier, checksum, completion identifier field, and total number of shards. The completion identifier field is used to indicate whether the data shard is the last data shard of the SBOM data.

[0092] Step 702: The data receiving end stores each data fragment in a fragment hash table based on the fragment information of each data fragment, and performs integrity verification on multiple data fragments.

[0093] Step 703: After multiple data fragments pass integrity verification, the data receiving end reassembles the multiple data fragments to obtain SBOM data.

[0094] In one possible implementation, this application designs a reassembly verification mechanism to address situations where SBOM data fragmentation is out of order or arrives late or ahead of schedule due to network jitter. The reassembly verification mechanism includes: a fragmentation reception and basic verification phase, a fragmentation processing phase carrying completion identifiers, a phase for determining the completion of SBOM data fragmentation transmission, and a timeout and retransmission processing phase.

[0095] Specifically, during the fragment reception and basic verification phase, when the data receiver receives any data fragment, the reassembly module will perform the following steps, regardless of the order in which the data fragments arrive: 1) Perform CRC32 verification on the received data fragments. If the cyclic redundancy check value of the components included in the data fragment is inconsistent with the check code, the verification fails, the data fragment is considered to be corrupted, and the data fragment is required to be retransmitted.

[0096] 2) For data shards that have been successfully verified, store them in the shard hash table using the shard ID and the current shard sequence number.

[0097] 3) Update the number of data fragments that have been received, and check if the completion flag field of the received data fragments is true (first field).

[0098] 4) When the number of received data fragments is less than the total number of fragments, start or refresh the 60-second reassembly timeout timer and wait for the subsequent data fragments to arrive.

[0099] During the processing phase of the data fragment carrying the completion flag, after receiving a data fragment with the completion flag field set to true, the reassembly module can make the following judgment: 1) The number of data fragments received so far is less than the total number of fragments. It is assumed that the data transmission has not yet ended. Only the status of the completion flag field is saved, and data reassembly is not performed for the time being.

[0100] 2) If multiple data fragments with completion flag fields are received, the data transmission is immediately determined to be erroneous and a retransmission mechanism is initiated.

[0101] 3) If the number of data fragments received so far is equal to the total number of fragments, and there is one and only one data fragment with a completion identifier field, then proceed to the dependency integrity verification process.

[0102] During the completion determination phase of SBOM data fragment transmission, the data receiver will only consider the SBOM data fragment transmission complete and trigger the reassembly verification procedure if all integrity verification conditions are met. The integrity verification conditions include: the number of received data fragments equals the total number of fragments; there is exactly one data fragment among the received data fragments with a completion flag of true; and all data fragments pass dependency integrity verification. Dependency integrity verification involves: traversing each component node within a data fragment; if a component has a parent node, its parent node must also be within the same data fragment; if its parent node is not within the same data fragment, the data fragment is considered corrupted; if all component dependencies are complete, the dependency verification passes.

[0103] During the timeout and retransmission processing phase, if the data receiver does not receive all data fragments within the 60-second reassembly timeout, a retransmission mechanism needs to be triggered. Lost data fragments are retransmitted using an exponential backoff strategy at retransmission intervals of 5 seconds, 10 seconds, 20 seconds, and 40 seconds. A maximum of four retransmissions are performed. If the maximum number of retransmissions is exceeded and the data receiver still has not received all data fragments, the retransmission process ends, and an SBOM transmission failure is reported.

[0104] In this embodiment, after receiving multiple data fragments and their fragmentation information, the data receiving end can store each data fragment based on its fragmentation information and perform integrity verification on the multiple data fragments. Only when the multiple data fragments pass integrity verification will they be reassembled to obtain the SBOM data. Thus, based on the fragment identifier, checksum, and completion identifier fields included in the fragmentation information, it is possible to verify whether the data included in each data fragment is complete, and whether the number of multiple data fragments is complete. Therefore, if the number of multiple data fragments is complete and the data included in each data fragment is complete, it can be determined that the multiple data fragments have passed integrity verification, thereby ensuring the semantic integrity of the SBOM data obtained after data reassembly.

[0105] Figure 8 This is the eighth flowchart of the SBOM fragmented transmission method provided by the present invention, applied to the data receiving end, such as... Figure 8 As shown, "Integrity verification of multiple data shards" includes the following: Step 801: The data receiving end determines whether the number of received data fragments is consistent with the total number of fragments, and whether the completion identifier field of one of the data fragments is the second field.

[0106] The second field indicates that the data shard is the last data shard of the SBOM data.

[0107] Step 802: The data receiving end determines whether the cyclic redundancy check value and check code of the components included in each data segment are consistent.

[0108] Step 803: The data receiving end determines whether the components included in each data shard and the parent node of the components are in the same data shard.

[0109] In one possible implementation, the integrity verification of multiple data shards can be understood as follows: the number of multiple data shards is consistent with the total number of shards, the completion identifier field of one of the multiple data shards is the second field, the cyclic redundancy check value of the components included in each data shard is consistent with the check code, and the components included in each data shard are in the same data shard as the parent node of the component.

[0110] In one possible implementation, a reassembly and verification layer reassembles data fragments based on their fragment IDs and verifies the integrity of dependencies. This reassembly and verification layer, located on the data receiving end, performs reassembly, verification, and final confirmation on the received data fragments.

[0111] Specifically, after receiving the data fragments, the data receiving end first classifies and manages the data fragments according to the fragment ID carried by the data fragments, and then stores the data fragments into the fragment hash table according to the current fragment sequence number and other information.

[0112] Furthermore, after all data fragments have been received, the reassembly and verification layer performs the following verification processes: fragment integrity verification, data integrity verification, and dependency integrity verification.

[0113] The fragment integrity verification process is as follows: if the number of received data fragments is consistent with the total number of fragments declared in the data fragments, and there is only one data fragment with a completion flag of true, then the fragment integrity verification is considered to have passed.

[0114] The data integrity verification process involves recalculating the CRC32 checksum for each data fragment and comparing it with the checksum carried in the data fragment. If the comparison matches, the data integrity verification is considered successful.

[0115] Dependency integrity verification specifically includes: traversing the component nodes in the data shard, checking any component; if the component has a parent node, then its parent node must be contained within the same data shard; if a component's parent node is found to be missing, then the data shard is determined to be invalid. When both the component and its parent node are contained within the same data shard, the dependency integrity verification is considered successful.

[0116] Only when all the above verification conditions are met will the reconstructed verification layer trigger the final reconstructing operation of the SBOM, and hand over the reconstructed SBOM data to the upper-layer module for subsequent processing such as vulnerability analysis and risk assessment.

[0117] For example, Figure 9 This is the ninth flowchart of the SBOM fragmentation transmission method provided by the present invention, as shown below. Figure 9 As shown, the process of SBOM data fragment reception and reassembly verification is as follows: The data receiver enters a waiting state. After receiving any fragment, it first performs a CRC32 check. If the check fails, the fragment is considered corrupted and a retransmission is requested. If the check passes, the fragment is stored in a hash table, the number of received fragments is updated, and the status of the current fragment completion flag is recorded. If the current fragment contains a completion flag and no fragment containing a completion flag has been received (i.e., no completion flag exists), the completion flag is recorded. Then, it checks whether all fragments have been received. If not, a 60-second reassembly timeout timer is started or refreshed. If the timeout occurs, a transmission error is determined and a fragment retransmission is requested. When the retransmission count reaches the upper limit, retransmission is terminated and a transmission failure is reported. Then, resources are released, and the process ends. If the retransmission count does not reach the upper limit, it waits for an exponential backoff time and then returns to the fragment reception state. If all fragments have been received, it checks whether there is one and only one completion flag. If not, a transmission error is determined and a retransmission is requested. If so, a dependency integrity check is performed. If the check passes, a reassembly check is triggered, and finally, SBOM reassembly is completed, achieving complete and reliable SBOM data reception and verification.

[0118] In this embodiment, when verifying the integrity of multiple data shards, the number of received data shards is determined based on the shard identifier to see if it matches the total number of shards. The completion identifier field is used to determine if the last data shard of the SBOM data has been received. This ensures the completeness of the number of data shards. Furthermore, by determining whether the cyclic redundancy check value of each component in each data shard matches the checksum in the shard information, and by determining whether each component and its parent node are in the same data shard, the completeness of the components in each data shard can be determined, and that the components in each data shard have complete dependencies. Finally, when the completeness of the number of data shards and the completeness and dependencies of the components in each data shard are confirmed, the data shards can be reassembled to ensure the semantic integrity of the SBOM data obtained after reassembly.

[0119] This application's embodiments perform SBOM fragmentation based on complete subgraphs. By ensuring that the parent node of any component within a fragment is included in the same fragment, the semantic integrity of component dependencies within the fragment is guaranteed, reducing dependency chain breakage rates and improving reassembly efficiency. Furthermore, the semantic integrity-based fragmentation method, since dependency integrity is guaranteed within fragments, reduces the complexity of cross-fragment dependency verification during the reassembly phase, improving overall system processing efficiency and resource utilization. A formal constraint system ensures the completeness and consistency of fragmentation results globally, improving the reliability of fragment transmission. A dynamic completion flag mechanism effectively avoids transmission end error determination problems caused by relying solely on completion flags, reducing the possibility of reassembly failure at the transmission link level and significantly improving the overall reliability of SBOM fragment transmission, adapting to complex network environments. This application possesses good composability and scalability, adapting to SBOM structures of different sizes and complexities, and supporting cross-platform, multi-protocol SBOM data transmission.

[0120] The SBOM fragmentation transmission device provided by the present invention is described below. The SBOM fragmentation transmission device described below can be referred to in correspondence with the SBOM fragmentation transmission method described above.

[0121] Figure 10 This is one of the structural schematic diagrams of the SBOM fragmentation transmission device provided by the present invention, such as... Figure 10 As shown, the SBOM fragmented transmission device, applied at the data sending end, includes the following modules: data conversion module 1001, data fragmentation module 1002, data verification module 1003, and data sending module 1004. The data conversion module is used to convert software bill of materials (SBOM) data into a directed acyclic graph (DAG). The SBOM data includes multiple components with dependencies between them. The data sharding module is used to divide SBOM data into multiple data shards based on DAG and the dependencies between multiple components. Each data shard includes at least one component, and the at least one component included in each data shard has complete dependencies between each other. The data verification module is used to determine the fragment information of each data fragment among multiple data fragments. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The data sending module is used to send multiple data fragments, along with fragment information for each data fragment, to the data receiving end.

[0122] According to the present invention, an SBOM fragmentation transmission device includes a data conversion module, which is specifically used for: Read SBOM data from the message queue, traverse and parse the SBOM data to determine the dependencies between multiple components; Based on the dependencies between multiple components, convert SBOM data into DAG; The DAG consists of multiple nodes and multiple directed edges. Each node corresponds to a component, and the node represents the component's attribute information, which includes at least one of the following: component identifier, component version number, parent node pointer, and child node pointer set. Each directed edge represents the dependency relationship between the corresponding two components.

[0123] According to the present invention, an SBOM fragmentation transmission device, specifically a data fragmentation module, is used for: Based on the DAG, the dependencies between multiple components are scanned to identify multiple component sets. Each component set includes at least one component, and the at least one component in each component set has complete dependencies between them. Multiple data shards are obtained based on multiple component sets. Each data shard includes at least one component set, and the amount of data included in a data shard is less than or equal to a preset amount of data.

[0124] According to the present invention, an SBOM fragmentation transmission device includes a data verification module, which is specifically used for: Generate a shard identifier for each of the multiple data shards. The shard identifier is determined based on the hash value corresponding to the sequence of components included in each data shard. The cyclic redundancy check value of the components included in each data shard is determined as the checksum; Generate a completion identifier field for each data shard. The completion identifier field is either the first field or the second field. The first field indicates that the data shard is not the last data shard of the SBOM data, and the second field indicates that the data shard is the last data shard of the SBOM data.

[0125] Figure 11 This is the second schematic diagram of the SBOM fragmentation transmission device provided by the present invention, as shown below. Figure 11 As shown, the SBOM fragmented transmission device is applied at the data receiving end and includes the following modules: data receiving module 1101, data storage module 1102 and data reassembly module 1103; The data receiving module is used to receive multiple data fragments and fragment information of each data fragment sent by the data sending end. The multiple data fragments are obtained by dividing the SBOM data. Each data fragment includes at least one component. The at least one component included in each data fragment has a complete dependency relationship. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The data storage module is used to store each data shard in a shard hash table based on the shard information of each data shard, and to perform integrity verification on multiple data shards; The data reassembly module is used to reassemble multiple data shards to obtain SBOM data after multiple data shards have passed integrity verification.

[0126] According to the present invention, an SBOM fragmentation transmission device and a data storage module are specifically used for: Determine whether the number of received data fragments matches the total number of fragments, and whether the completion identifier field of one of the data fragments is the second field, where the second field indicates that the data fragment is the last data fragment of the SBOM data; Determine whether the cyclic redundancy check value and check code of the components included in each data shard are consistent; Determine whether the components included in each data shard are in the same data shard as their parent nodes.

[0127] Figure 12 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 12As shown, the electronic device may include: a processor 1210, a communications interface 1220, a memory 1230, and a communication bus 1240, wherein the processor 1210, the communications interface 1220, and the memory 1230 communicate with each other through the communication bus 1240. The processor 1210 can call logic instructions in the memory 1230 to execute an SBOM fragmentation transfer method, the method comprising: converting software bill of materials (SBOM) data into a directed acyclic graph (DAG), the SBOM data including multiple components with dependencies between the components; dividing the SBOM data into multiple data fragments based on the DAG and the dependencies between the components, each data fragment including at least one component, the at least one component in each data fragment having complete dependencies between them; determining fragmentation information for each data fragment, the fragmentation information including at least one of the following: fragment identifier, checksum, completion identifier field, total number of fragments, the completion identifier field indicating whether the data fragment is the last data fragment of the SBOM data; and sending the multiple data fragments and the fragmentation information for each data fragment to a data receiving end. Alternatively, it may include: receiving multiple data fragments and fragment information for each data fragment sent by the data sender; storing each data fragment in a fragment hash table based on the fragment information of each data fragment, and performing integrity verification on multiple data fragments; and reassembling multiple data fragments to obtain SBOM data if multiple data fragments pass integrity verification.

[0128] Furthermore, the logical instructions in the aforementioned memory 1230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the SBOM fragmentation transmission method provided by the above methods. The method includes: converting software bill of materials (SBOM) data into a directed acyclic graph (DAG), the SBOM data including multiple components with dependencies between the components; dividing the SBOM data into multiple data fragments based on the DAG and the dependencies between the components, each data fragment including at least one component, and the at least one component in each data fragment having complete dependencies between them; determining the fragmentation information of each data fragment, the fragmentation information including at least one of the following: fragment identifier, checksum, completion identifier field, and total number of fragments, the completion identifier field indicating whether the data fragment is the last data fragment of the SBOM data; and sending the multiple data fragments and the fragmentation information of each data fragment to a data receiving end. Alternatively, it may include: receiving multiple data fragments and fragment information for each data fragment sent by the data sender; storing each data fragment in a fragment hash table based on the fragment information of each data fragment, and performing integrity verification on multiple data fragments; and reassembling multiple data fragments to obtain SBOM data if multiple data fragments pass integrity verification.

[0130] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the SBOM fragmentation transmission method provided by the above methods. The method includes: converting software bill of materials (SBOM) data into a directed acyclic graph (DAG), the SBOM data including multiple components with dependencies between the components; dividing the SBOM data into multiple data fragments based on the DAG and the dependencies between the components, each data fragment including at least one component, and the at least one component in each data fragment having complete dependencies between them; determining fragmentation information for each data fragment, the fragmentation information including at least one of the following: fragment identifier, checksum, completion identifier field, and total number of fragments, the completion identifier field indicating whether the data fragment is the last data fragment of the SBOM data; and sending the multiple data fragments and the fragmentation information for each data fragment to a data receiving end. Alternatively, it may include: receiving multiple data fragments and fragment information for each data fragment sent by the data sender; storing each data fragment in a fragment hash table based on the fragment information of each data fragment, and performing integrity verification on multiple data fragments; and reassembling multiple data fragments to obtain SBOM data if multiple data fragments pass integrity verification.

[0131] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for SBOM fragmented transmission, characterized in that, Applied to the data sending end, the method includes: The software bill of materials (SBOM) data is converted into a directed acyclic graph (DAG), where the SBOM data includes multiple components with dependencies between them. Based on the dependencies between the DAG and the multiple components, the SBOM data is divided into multiple data shards. Each data shard includes at least one component, and the at least one component included in each data shard has a complete dependency relationship. Determine the fragment information of each data fragment among the plurality of data fragments. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The multiple data fragments, along with the fragmentation information for each data fragment, are sent to the data receiving end.

2. The SBOM fragmentation transmission method according to claim 1, characterized in that, The process of converting software bill of materials (SBOM) data into a directed acyclic graph (DAG) includes: Read the SBOM data from the message queue, and traverse and parse the SBOM data to determine the dependencies between the multiple components; Based on the dependencies between the multiple components, the SBOM data is converted into the DAG; The DAG includes multiple nodes and multiple directed edges. Each node corresponds to a component, and the node represents the component's attribute information. The attribute information includes at least one of the following: component identifier, component version number, parent node pointer, and child node pointer set. Each directed edge represents the dependency relationship between two corresponding components.

3. The SBOM fragmentation transmission method according to claim 1, characterized in that, Based on the dependencies between the DAG and the multiple components, the SBOM data is divided into multiple data fragments, including: Based on the DAG, the dependencies between the multiple components are scanned to determine multiple component sets. Each component set includes at least one component, and the at least one component in each component set has a complete dependency relationship. The multiple data shards are obtained based on the multiple component sets. Each data shard includes at least one component set, and the amount of data included in a data shard is less than or equal to a preset amount of data.

4. The SBOM fragmentation transmission method according to claim 1, characterized in that, Determining the fragment information of each data fragment among the plurality of data fragments includes: A shard identifier is generated for each of the plurality of data shards, the shard identifier being determined based on the hash value corresponding to the sequence of components included in each data shard; The cyclic redundancy check value of the components included in each data shard is determined as the check code; A completion identifier field is generated for each data shard. The completion identifier field is either a first field or a second field. The first field indicates that the data shard is not the last data shard of the SBOM data, and the second field indicates that the data shard is the last data shard of the SBOM data.

5. A method for SBOM fragmented transmission, characterized in that, Applied to a data receiving end, the method includes: The system receives multiple data fragments and fragment information for each data fragment sent by the data sender. The multiple data fragments are obtained by dividing the SBOM data. Each data fragment includes at least one component, and the at least one component included in each data fragment has a complete dependency relationship. The fragment information includes at least one of the following: fragment identifier, checksum, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. Based on the sharding information of each data shard, each data shard is stored in a sharding hash table, and the integrity of the multiple data shards is verified. If the multiple data shards pass the integrity verification, the multiple data shards are reassembled to obtain the SBOM data.

6. The SBOM fragmentation transmission method according to claim 5, characterized in that, The integrity verification of the multiple data shards includes: Determine whether the number of received multiple data fragments is consistent with the total number of fragments, and whether the completion identifier field of one of the multiple data fragments is the second field, wherein the second field indicates that the data fragment is the last data fragment of the SBOM data; Determine whether the cyclic redundancy check value of the components included in each data shard is consistent with the check code; Determine whether the components included in each data shard are in the same data shard as their parent nodes.

7. An SBOM fragmentation transmission device, characterized in that, The device, applied to a data sending end, includes: a data conversion module, a data fragmentation module, a data verification module, and a data sending module; The data conversion module is used to convert the software bill of materials (SBOM) data into a directed acyclic graph (DAG). The SBOM data includes multiple components, and there are dependencies between the multiple components. The data sharding module is used to divide the SBOM data into multiple data shards based on the dependencies between the DAG and the multiple components. Each data shard includes at least one component, and the at least one component included in each data shard has a complete dependency relationship. The data verification module is used to determine the fragment information of each data fragment among the plurality of data fragments. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The data sending module is used to send the multiple data fragments and the fragment information of each data fragment to the data receiving end.

8. An SBOM fragmentation transmission device, characterized in that, The device, used at a data receiving end, includes: a data receiving module, a data storage module, and a data reassembly module; The data receiving module is used to receive multiple data fragments and fragment information of each data fragment sent by the data sending end. The multiple data fragments are obtained by dividing the SBOM data. Each data fragment includes at least one component, and the at least one component included in each data fragment has a complete dependency relationship. The fragment information includes at least one of the following: fragment identifier, check code, completion identifier field, and total number of fragments. The completion identifier field is used to indicate whether the data fragment is the last data fragment of the SBOM data. The data storage module is used to store each data shard in a shard hash table based on the shard information of each data shard, and to perform integrity verification on the multiple data shards. The data reassembly module is used to reassemble the multiple data fragments to obtain the SBOM data when the multiple data fragments pass the integrity verification.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the SBOM fragmentation transmission method as described in any one of claims 1 to 4, or the SBOM fragmentation transmission method as described in any one of claims 5 to 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the SBOM fragmentation transmission method as described in any one of claims 1 to 4, or the SBOM fragmentation transmission method as described in any one of claims 5 to 6.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the SBOM fragmentation transmission method as described in any one of claims 1 to 4, or the SBOM fragmentation transmission method as described in any one of claims 5 to 6.

Images