Software parts bill generation device and software parts bill generation method

Abstract

A software bill of materials is generated using design information as input. [Solution] The software parts bill generation device 100 includes a generation unit 111 that extracts component names, version information, and inter-component relationships from design information including components included in software and inter-component relationships, which are the relationships between the components, and generates and outputs a software parts bill including the extracted component names, version information, and inter-component relationships.

Description

[Technical Field]

[0001] The present invention relates to a software parts bill generating device and a software parts bill generating method for generating a software parts bill. [Background technology]

[0002] When developing software, open source software or components (parts, modules) developed by third parties may be used in order to minimize cost and development time. These components may have vulnerabilities or security issues. Using a software bill of materials (SBOM), which shows what components the software is made up of, improves transparency of the components and makes it easier to identify the source of problems.

[0003] The software bill of materials also includes component license information and inter-component dependencies. By referencing the software bill of materials, you can check for license violations, including for components that are indirectly used.

[0004] One example of an invention related to creating a software bill of materials (BOM) is a tool that generates a BOM using binary or source code as input. Patent Document 1 (Patent Document 1) also describes a method for creating a BOM (Bill of Materials) based on a design specification. The BOM creation method based on a design specification includes the following steps: (1) defining a system architecture and a process flow; (2) defining a plurality of components composed of programmable units; (3) generating a plurality of separate part numbers corresponding to each of the plurality of components using a part number generator; (4) defining any of the characteristics of the plurality of components, such as logical definition operations, documents, numerical values, numerical ranges, properties, input / output interrelationships, or dependency relationships; and (5) creating a BOM based on the design specification. The system architecture and process flow are determined by two different relationships among multiple forms formed by multiple combinations of multiple components. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2020-027535 Summary of the Invention [Problem to be solved by the invention]

[0006] In the invention described in Patent Document 1, a BOM (software bill of materials) is created over time based on input information (see paragraph 0038 of the specification). In essence, this invention creates a BOM together with a design specification, but does not generate a BOM using an already-created design specification as input. With this invention, it is not possible to generate a BOM based on, for example, an existing design specification.

[0007] In development, design information (design specifications) is created using various tools, including word processing software and spreadsheet software. It is desirable to generate a software bill of materials using the design information as input. The present invention has been made in view of the above background, and an object of the present invention is to provide a software parts bill generating device and a software parts bill generating method that generate a software parts bill using design information as input. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, a software parts bill of materials generation device according to the present invention includes a generation unit that extracts names of components, version information, and inter-component relationships from design information including components included in software and inter-component relationships that are relationships between the components, and generates and outputs a software parts bill of materials including the extracted names of the components, the version information, and the inter-component relationships. The design information is a diagram in which the components are described as blocks and the inter-component relationships are described as arrows connecting the blocks, and the generation unit generates the software bill of materials by processing, using a language model, an instruction to extract the names of the components, the version information, and the inter-component relationships by referring to the diagram and generating the software bill of materials, and a prompt including the diagram. . Furthermore, a software bill of materials generation device according to the present invention includes a generation unit that extracts names of components, version information, and inter-component relationships from design information including components included in software and the inter-component relationships between the components, and generates and outputs a software bill of materials including the extracted names of the components, the version information, and the inter-component relationships, wherein the design information is a diagram in which the components are described as blocks and the inter-component relationships are described as arrows connecting the blocks, and the generation unit processes, using a language model, an instruction to extract the names of the components, the version information, and the inter-component relationships as text-format design information by referring to the diagram, and a prompt including the diagram, and extracts the names of the components, the version information, and the inter-component relationships from the extracted text-format design information, and generates and outputs the software bill of materials. [Effects of the Invention]

[0009] According to the present invention, it is possible to provide a software parts bill generation device and a software parts bill generation method that generate a software parts bill using design information as input. Problems, configurations, and effects other than those described above will become apparent from the description of the following embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is an example of design information described in a block diagram in the embodiment described below. [Figure 2] 1 is an example of design information written in PlantUML notation in the embodiment described below. [Figure 3] 10 is an example of design information written in Mermaid notation in the embodiment described below. [Figure 4] 1 is a functional block diagram of a software parts table generation device according to a first embodiment. [Figure 5] FIG. 2 is a diagram showing a software parts table according to the first embodiment. [Figure 6] 10 is a flowchart of a generation process according to the first embodiment. [Figure 7] FIG. 10 is a functional block diagram of a software parts table generation device according to a second embodiment. [Figure 8] FIG. 11 is a diagram showing the configuration of a prompt according to the second embodiment. [Figure 9] FIG. 10 is a functional block diagram of a software parts table generation device according to a third embodiment. [Figure 10] FIG. 11 is a diagram showing the configuration of a prompt according to the third embodiment. [Figure 11] FIG. 11 is a diagram showing the configuration of a prompt according to a modified example of the third embodiment. [Figure 12] FIG. 2 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the software parts table generation device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] <<Outline of the software bill of materials generator>> A software bill of materials generation device according to an embodiment of the present invention will be described below. The software bill of materials generation device extracts component names, version information, and dependencies from design information including components included in software and the dependencies between those components. The software bill of materials generation device then accesses a source code repository server to obtain location information and license information for obtaining the components. The software bill of materials generation device then generates and outputs a software bill of materials including component names, version information, dependencies, etc. This software bill of materials generation device can generate a software bill of materials using design information as input.

[0012] Software design information includes the names and version information of components included in the software, as well as dependencies between the components. FIG. 1 is an example of design information 310 described in a block diagram in the embodiment described below. In FIG. 1, the software is configured to include a first component and a second component. The version of the first component is 3, and the version of the second component is 1.2. The first component calls the second component, and the first component depends on the second component.

[0013] The design information can also be written in a text format such as PlantUML notation or Mermaid notation. Fig. 2 shows an example of design information 320 written in PlantUML notation in the embodiment described below. Fig. 3 shows an example of design information 330 written in Mermaid notation in the embodiment described below. The description contents of the design information 320 and 330 are the same as the design information 310 shown in Fig. 1.

[0014] <Configuration of software bill of materials generation device> 4 is a functional block diagram of a software parts bill of materials generation device 100 according to the first embodiment. The software parts bill of materials generation device 100 is a computer, and includes a control unit 110, a storage unit 120, and an input / output unit 180. User interface devices such as a display, keyboard, and mouse are connected to the input / output unit 180. A media drive may also be connected to the input / output unit 180, enabling data exchange using a recording medium.

[0015] The input / output unit 180 includes a communication device and is capable of transmitting and receiving data to and from the source code repository server 210. The source code repository server 210 stores the source code of components included in the software, the source (location information) of the components, and license information.

[0016] <Software parts bill generation device: storage unit> The storage unit 120 is configured to include storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 stores a program 128. The program 128 includes a description of the processes to be executed by functional units of the control unit 110, which will be described later. Note that the various storage contents of the storage unit 120 may be stored in an external storage device such as a cloud server and read as needed.

[0017] <Software parts bill generation device: control unit> The control unit 110 is configured to include a CPU (Central Processing Unit) and is provided with a generation unit 111. The control unit 110 may be configured to include a GPU (Graphics Processing Unit), an NPU (Neural (network) Processing Unit), an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), or the like.

[0018] The generation unit 111 generates a software parts list from the input design information. The design information in the first embodiment is text-format design information 320, 330 (see FIGS. 2 and 3). The generation unit 111 reads the design information 320, 330, analyzes the syntax of the text, and extracts component names, version information, and dependency relationships (call relationships).

[0019] Next, the generation unit 111 accesses the source code repository server 210 to acquire related information about the component. The related information includes, but is not limited to, the following: PackageFileName: The file name of the package that contains the component. PackageDownloadLocation: Where to get the package. If you get it from an external source, it will be a URL. If you implement it yourself, it will be "NOASSERTION". PackageLicenseConcluded: The license information that has been determined to apply to the package. PackageLicenseDeclared: The license information declared to apply to the package. CopyrightText:Copyright of the package.

[0020] Next, the generation unit 111 generates a software component table 340 (see FIG. 5 described later) that includes component names, version information, dependency relationships, and related information. FIG. 5 is a diagram showing the software component table 340 according to the first embodiment. Section 341 describes information related to the first component, such as the name, file name, and source of acquisition. Section 342 describes information related to the second component, such as the name, file name, and source of acquisition. Section 343 describes the dependency relationship between the first component and the second component.

[0021] As described above, the software parts bill of materials generation device 100 includes a generation unit 111 that extracts component names, version information, and inter-component relationships from design information 320, 330 that includes components included in the software and inter-component relationships, which are relationships between the components. The generating unit 111 generates and outputs a software parts table 340 including the names of the extracted components, version information, and inter-component relationships. The generating unit 111 acquires location information and license information for acquiring the component from a repository (see the source code repository server 210) that stores the source code of the component, and includes the information in the software parts table 340. The design information 320 and 330 are descriptions in text format (for example, PlantUML notation or Mermaid notation). The generation unit 111 extracts component names, version information, and inter-component relationships from the design information 320 and 330, and generates and outputs a software parts list 340.

[0022] <<Generation Process>> Fig. 6 is a flowchart of the generation process according to the first embodiment. The process of inputting design information 320, 330 (see Figs. 2 and 3) written in text format and generating a software parts table 340 (see Fig. 5) will be described with reference to Fig. 6.

[0023] In step S11, the generation unit 111 reads the design information 320 and 330. In step S12, the generation unit 111 analyzes the syntax of the text read in step S11, and extracts the component names, version information, and dependency relationships (call relationships).

[0024] In step S13, the generation unit 111 starts the process of repeatedly executing step S14 for each component. In step S14, the generation unit 111 acquires the component related information from the source code repository server 210. In step S15, the generating unit 111 generates a software parts table 340 (see FIG. 5) including names and version information of components, dependency relationships, and related information.

[0025] <Features of the software bill of materials generator> The software parts bill of materials generation device 100 analyzes the design information 320, 330 in text format to generate the software parts bill of materials 340. The design information 320, 330 is created in the upstream process of the software, and the user of the software parts bill of materials generation device 100 can generate the software parts bill of materials 340 without any additional effort.

[0026] Second Embodiment In the first embodiment, the generation unit 111 reads the design information 320, 330, which is text, analyzes the syntax, acquires the names of components, and generates the software parts bill 340. The generation unit may use a language model for analyzing the syntax and generating the software parts bill.

[0027] 7 is a functional block diagram of a software BOM generation device 100A according to the second embodiment. The language model server 220 is a server that provides services such as AI chatbots and conversational AI. The language model server 220 processes input data called prompts sent by the software BOM generation device 100A using a large-scale language model, and returns a response as the processing result.

[0028] The software parts bill of materials generation device 100A is different from the software parts bill of materials generation device 100 of the first embodiment in that the generation unit 111A generates a prompt 410 (see FIG. 8 described later), transmits it to the language model server 220, and obtains a software parts bill of materials 340 as a response.

[0029] 8 is a diagram showing the configuration of a prompt 410 according to the second embodiment. An element 411 of the prompt includes an instruction to extract component names and dependencies from the input design information in an element 412. The element 411 also includes an instruction to access the source code repository server 210 and obtain component-related information, as described in an element 413. The element 411 also includes an instruction to generate a software bill of materials (SBOM) based on the component names, dependencies, and related information.

[0030] Third Embodiment In the first and second embodiments, the software parts bill of materials generation devices 100 and 100A receive text-format design information 320 and 330. Block diagram design information 310 (see FIG. 1) may also be received as input.

[0031] 9 is a functional block diagram of a software parts bill of materials generation device 100B according to the third embodiment. The software parts bill of materials generation device 100B differs from the software parts bill of materials generation device 100 according to the first embodiment (see FIG. 4) in that it includes a generation unit 111B. The generation unit 111B generates a prompt 420 (see FIG. 10, which will be described later), transmits it to the language model server 220, and obtains design information 330 (see FIG. 3), which is written in Mermaid notation, as a response.

[0032] Next, the generation unit 111B receives the acquired design information 330 as an input, and generates and acquires a software components table 340 in the same manner as the generation unit 111 of the first embodiment. The generation unit 111B may receive the acquired design information 330 as an input, and generate and acquires a software components table 340 in the same manner as the generation unit 111A of the second embodiment.

[0033] 10 is a diagram showing the configuration of a prompt 420 according to the third embodiment. An element 421 of the prompt 420 includes an instruction to convert the input block diagram design information 310 (see FIG. 1) in element 422 into design information 330 written in Mermaid notation. Element 422 describes the design information 310 as an image encoded using BASE64. Note that the converted text may be in a text format including PlantUML notation instead of Mermaid notation.

[0034] According to the software parts bill generation device 100B, it is possible to generate a software parts bill 340 based on the design information 310 of the block diagram.

[0035] As described above, the design information 310 (see FIG. 1) is a diagram in which components are described as blocks and the relationships between the components are described as arrows connecting the blocks. The generation unit 111B processes the prompt 420 including the instruction to extract component names, version information, and inter-component relationships as design information in text format by referring to the diagram, using a language model (see the language model server 220). The generating unit 111B extracts component names, version information, and inter-component relationships from the extracted text-format design information, and generates and outputs a software parts table 340.

[0036] Third Embodiment: Modified Example The software parts bill of materials generation device 100B described above converts design information 310 of a block diagram into design information 320, 330 in Mermaid notation or PlantUML notation to generate a software parts bill of materials 340. The software parts bill of materials generation device 100B may also generate the software parts bill of materials 340 by inputting the design information 310 of the block diagram without converting it into text format. In this case, the generation unit 111B generates a prompt 430 (see FIG. 11 described later), transmits it to the language model server 220, and receives the software parts bill of materials 340 as a response.

[0037] 11 is a diagram showing the configuration of a prompt 430 according to a modification of the third embodiment. An element 431 of the prompt includes an instruction to extract component names and dependencies from the design information of the input block diagram in an element 432. The element 431 also includes an instruction to access the source code repository server 210 and acquire component-related information, as described in an element 433. The element 431 further includes an instruction to generate a software bill of materials (SBOM) based on the component names, dependencies, and related information.

[0038] As described above, the generation unit 111 generates the software parts bill 340 by processing the instruction to extract component names, version information, and inter-component relationships by referring to a diagram (see design information 310) and the prompt 430 including the diagram, using a language model (see language model server 220).

[0039] <<Modification: Language Model Server>> In the above embodiment, the generators 111A, 111B process the prompts 410, 420, 430 using the language model server 220. The generators 111A, 111B may also process the prompts 410, 420, 430 themselves using a language model.

[0040] <<Variation: Relationship between modules>> In the above-described embodiment, the relationship between components described in the software parts table 340 is a relationship in which one component depends on the other component (a calling relationship). The generation units 111, 111A, and 111B may extract other relationships from the design information and include them in the software parts table 340. Examples of other relationships include relationships in which one includes the other, is necessary during development, or is necessary during test execution.

[0041] As described above, the inter-component relationships include at least one of a relationship in which one component depends on another component and a relationship in which one component includes another component.

[0042] Other variations Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. For example, prompts 420 and 430 include encoded image design information 310 (see elements 422 and 432). Prompts 420 and 430 may include location information (e.g., a URL) of the design information 310 instead of the encoded design information 310.

[0043] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents.

[0044] <Hardware configuration> The software parts bill of materials generation devices 100, 100A, and 100B according to the above-described embodiments are realized by a computer 900 having a configuration as shown in FIG. 12, for example. FIG. 12 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the software parts bill of materials generation devices 100, 100A, and 100B according to the above-described embodiments. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, and an input / output interface 905 (referred to as an input / output I / F (Interface) in FIG. 12). The computer 900 also includes a communication interface 906 (referred to as a communication I / F in FIG. 12) and a media interface 907 (referred to as a media I / F in FIG. 12). The computer 900 may include a hard disk drive (HDD) instead of the SSD 904, or may include a HDD in addition to the SSD 904.

[0045] The CPU 901 operates based on a program stored in the ROM 902 or the SSD 904, and performs control by the control unit 110 in Fig. 4. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 starts up, programs related to the hardware of the computer 900, and the like.

[0046] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 via the input / output interface 905, and outputs generated data to the output device 911.

[0047] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (e.g., the source code repository server 210) via a communication network and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0048] The media interface 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads the program from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical disk), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0049] For example, when the computer 900 functions as the software parts bill of materials generation devices 100, 100A, and 100B according to the above-described embodiments, the CPU 901 of the computer 900 executes the program 128 (see FIG. 4) loaded onto the RAM 903, thereby realizing the functions of the software parts bill of materials generation devices 100, 100A, and 100B. The CPU 901 reads the program from the recording medium 912 and executes it. Alternatively, the CPU 901 may read the program from another device via a communication network, or may install the program 128 from the recording medium 912 onto the SSD 904 and execute it. [Explanation of symbols]

[0050] 100, 100A, 100B Software bill of materials generator 111,111A,111B generation part 210 Source Code Repository Server (Repository) 220 Language Model Server (Language Model) 310,320,330 Design information 340 Software Bill of Materials 410,420,430 prompt

Claims

1. extracting names of components, version information, and inter-component relationships from design information including components included in the software and inter-component relationships that are relationships between the components; a generating unit that generates and outputs a software parts list including the names of the extracted components, the version information, and the inter-component relationships; The design information is A diagram in which the components are described as blocks and the relationships between the components are described as arrows connecting the blocks, The generation unit An instruction to generate the software bill of materials by extracting the component names, the version information, and the component relationships by referring to the diagram, and a prompt including the diagram are processed using a language model to generate the software bill of materials. Software bill of materials generator.

2. extracting names of components, version information, and inter-component relationships from design information including components included in the software and inter-component relationships that are relationships between the components; a generating unit that generates and outputs a software parts list including the names of the extracted components, the version information, and the inter-component relationships; The design information is A diagram in which the components are described as blocks and the relationships between the components are described as arrows connecting the blocks, The generation unit processing, using a language model, instructions to extract the component names, the version information, and the component relationships as design information in text format by referring to the diagram, and a prompt including the diagram; The component names, the version information, and the inter-component relationships are extracted from the extracted text-format design information, and the software parts list is generated and output. Software bill of materials generator.

3. The generation unit Acquire location information and license information for acquiring the component from a repository storing the source code of the component, and include the information in the software bill of materials.

3. The software parts table generation device according to claim 1.

4. The inter-component relationships are: The relationship includes at least one of the following: one component depends on the other component; and one component includes the other component.

4. The software parts table generation device according to claim 3.

5. A software bill of materials generation device extracting names of components, version information, and inter-component relationships from design information including components included in the software and inter-component relationships that are relationships between the components; generating and outputting a software parts list including the names of the extracted components, the version information, and the inter-component relationships; The design information is A diagram in which the components are described as blocks and the relationships between the components are described as arrows connecting the blocks, In the step of generating and outputting the software bill of materials, An instruction to generate the software bill of materials by extracting the component names, the version information, and the component relationships by referring to the diagram, and a prompt including the diagram are processed using a language model to generate the software bill of materials. Software bill of materials generation method.

6. A software bill of materials generation device extracting names of components, version information, and inter-component relationships from design information including components included in the software and inter-component relationships that are relationships between the components; generating and outputting a software parts list including the names of the extracted components, the version information, and the inter-component relationships; The design information is A diagram in which the components are described as blocks and the relationships between the components are described as arrows connecting the blocks, In the step of generating and outputting the software bill of materials, processing, using a language model, instructions to extract the component names, the version information, and the component relationships as design information in text format by referring to the diagram, and a prompt including the diagram; The component names, the version information, and the inter-component relationships are extracted from the extracted text-format design information, and the software parts list is generated and output. Software bill of materials generation method.

Images