Blockchain SBOM Provenance With Hash-Based Audit History
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no standardized technique for storing and consuming software bill of materials (SBOM) that ensures integrity and provenance, leading to security risks from third-party components in software applications.
Innovation Solution
A secure and distributed system that utilizes a public blockchain to store and manage SBOMs, ensuring their integrity and provenance by generating hashes and storing them on a decentralized system, allowing for transparent and tamper-proof tracking of software components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SBOM is stored using traditional centralized systems, then storage and retrieval is simple, but integrity and provenance cannot be ensured
Solution Approach 1:
The patent introduces a blockchain network as an intermediary layer between SBOM creators and consumers. The blockchain acts as a trusted mediator that verifies and records SBOM data without requiring direct trust between parties. Smart contracts serve as automated intermediaries that enforce integrity checks and provenance verification, resolving the contradiction by adding a mediating layer that ensures reliability while managing complexity through automation.
Solution Approach 2:
The patent creates cryptographic copies (hashes) of SBOM data that are stored on the blockchain. Instead of storing the entire SBOM on the distributed system, only immutable cryptographic representations are persisted, while the full data can be retrieved and verified. This copying approach ensures integrity through cryptographic verification while reducing the complexity of managing large distributed storage systems.
2Loss of information
If SBOM is stored on a public blockchain, then transparency and tamper-proof tracking is achieved, but storage cost and complexity increases
Solution Approach 1:
The patent extracts only the essential integrity-critical information (cryptographic hashes of SBOM) and stores it on the blockchain, while keeping the full SBOM data in traditional storage systems. This extraction approach achieves transparency and tamper-proof tracking for the most critical data elements without the prohibitive cost and complexity of storing entire SBOM datasets on the blockchain.
Solution Approach 2:
The patent segments the SBOM storage system into two parts: immutable cryptographic proofs on the blockchain and mutable full data in traditional storage. This segmentation allows the system to achieve transparency and traceability for verification purposes while maintaining the flexibility and cost-effectiveness of conventional storage for the actual data, thus reducing overall system complexity.
3Reliability
If traditional SBOM management is used, then operational cost is lower, but security risks from third-party components increase
Solution Approach 1:
The patent performs preliminary verification of SBOM integrity and provenance through cryptographic checks before software components are deployed or updated. By conducting security verification in advance rather than during runtime or after security incidents, the system reduces security risks while keeping operational costs low, as the verification uses efficient cryptographic algorithms rather than continuous monitoring.
Data Source
AI summary
Disclosed is a secure and distributed system for storing and consuming software bill of materials (SBOM). The system allows software publishers to create a software component and generate an SBOM that describes its dependencies. A web API then securely stores the SBOM on a distributed file system and publishes a hash of the SBOM to a public blockchain. When the software component is updated, a new SBOM is generated, and a signed hash of the new SBOM is stored in a new node on the blockchain. This preserves the history and auditability of the application's SBOMs. Third parties may query the web API to obtain the SBOM while ensuring the integrity and provenance of the information.