|
We have presented the architecture and processes of BC-SBOM system.
For future work, we plan to implement a prototype of the system. And some considerations are being made.
The blockchain network used in BC-SBOM will be a hybrid of Ethereum and Hyperledger Indy. The DID management participant authentication is conducted on Hyperledger Indy to enhance security. And,SW component and dependency information is managed using smart contracts on Ethereum, allowing anyone to easily query.
The cost of using the blockchain network needs to be considered because In Ethereum, transaction fee must be paid for each transaction.
In our system, registering new SBOMs requires transaction fee. However, frequent dependency query does not require transaction fee because it does not alter the state on Ethereum. So the call method is used instead of transaction for query to minimize costs.
|