ICACT20250067 Slide.17
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Thank you for your attention and engagement during this presentation.
|
|
ICACT20250067 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
As we wrap up our presentation, let's briefly revisit the strength of our Blockchain-based SBOM system.
Our system offers secure storage and sharing of SBOMs, provides a global view representing dependencies among software components, and facilitates rapid propagation of alerts for new vulnerabilities.
And we expect that our system will assist in managing complex software systems and contribute to enhanced security.
|
|
ICACT20250067 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We have presented the architecture and processes of BC-SBOM system.
For future work, we plan to implement a prototype of the system. And some considerations are being made.
The blockchain network used in BC-SBOM will be a hybrid of Ethereum and Hyperledger Indy. The DID management participant authentication is conducted on Hyperledger Indy to enhance security. And,SW component and dependency information is managed using smart contracts on Ethereum, allowing anyone to easily query.
The cost of using the blockchain network needs to be considered because In Ethereum, transaction fee must be paid for each transaction.
In our system, registering new SBOMs requires transaction fee. However, frequent dependency query does not require transaction fee because it does not alter the state on Ethereum. So the call method is used instead of transaction for query to minimize costs.
|
|
ICACT20250067 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This diagram shows the process of vulnerability alert propagation within our system.
Step 1: The process initiates when a security expert identifies a new vulnerability affecting a software component, in this case, 'AAA'. The expert informs this vulnerability to the system.
Step 2: The service then requests DID document of 'AAA' from the DID resolver.
Step 3: Once the DID document is retrieved, the service discovers the address of SC_AAA.
Step 4: The service notifies SCAAA of the newly discovered vulnerability and triggers the creation and propagation of an alert.
Step 5: SCAAA emits an alert event containing vulnerability information. The components with a direct dependency on AAA listen to this event, and then generate and emit their own alert events. This process continues recursively, propagating the alerts to all components that have transitive dependencies with AAA.
Step 6: Participants who subscribed to receive events about XXX receive the alert event on XXX, becoming aware of the vulnerability in AAA that they depend on, and can promptly respond.
|
|
ICACT20250067 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Another important functionality of SBOM is the ability to quickly identify related software components when a new vulnerability is discovered, thereby enabling prompt response.
Out system leverages the blockchain's event handling mechanisms to automatically and quickly notify participants using the affected components regarding the new vulnerability.
|
|
ICACT20250067 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This diagram outlines the process flow of querying software dependencies.
Step 1: The process begins with a user querying the dependency information for a specific software component 'XXX'.
Step 2: The system then requests the DID document of 'XXX' from the DID resolver to discover the address of smart contract SC_XXX.
Step 3: The DID document of 'XXX' is retrieved
Step 4: The query service requests dependency information of XXX from SCXXX. The SCXXX retrieves the addresses of the smart contracts for YYY and ZZZ from its relationship mapping. It then requests and receives dependency information from SCYYY and SCZZZ.
This querying process is recursive; for example, upon receiving a request from SCXXX, SCZZZ requests and compiles dependency information from its direct dependency components AAA and BBB, aggregates this data, and provides its complete dependency information back to SCXXX.
Step 5: SCXXX aggregates the dependency information received from SCYYY and SCZZZ to generate its comprehensive dependency information. This information encompasses not only the direct dependencies of XXX but also all components in a transitive dependency relationship.
Step 6: This comprehensive dependency information of XXX is provided back to the user who initiated the request through the query service.
This dependency information is automatically generated by the blockchain's smart contracts, ensuring tamper-proof data and high trustworthiness.
|
|
ICACT20250067 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Here we will discuss the SW dependency query within our BC-SBOM system.
Identifying dependencies between software components is very crucial especially in large-scale software systems. And it needs reliable and up-to-date SBOMs for all relevant components. But, analyzing dependencies can be both complex and resource-intensive.
Our BC-SBOM system provides efficient dependency query. By leveraging a shared global dependency view, it allows participants to quickly and accurately query dependency.
|
|
ICACT20250067 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In this diagram, we can see the detailed process of SBOM registration.
Step 1: The process begins when an SBOM is registered. For example, a software developer submits an SBOM for a specific software product, which includes the name XXX, identifier, and relationships to other components.
Step 2: This SBOM is then stored in the SBOM registry. This storage is immutable, ensuring that the data cannot be tampered.
Step 3: Then, a smart contract for the software XXX is created. This smart contract contains not only software information defined in the SBOM but also all the logic for managing dependencies.
Step 4: The system then requests the DID documents for any related components—denoted here as YYY and ZZZ.
Step 5: The DID resolver fetches these documents from the DID registry. These documents also contain the address of corresponding smart contract.
Step 6: The smart contract SCxxx then links to other smart contracts SCyyy and SCzzz, which manage the related components. This linking helps maintaining an up-to-date view of all dependencies and interactions between software components.
Step 7: Finally, the DID document of XXX is registered in the DID registry.
|
|
ICACT20250067 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Let's focus on the SBOM Registration process within our system.
When an SBOM is registered in our system, it contributes to building a global dependency view of all software components.
This view is based on blockchain, thus it guarantees high trustworthy, integrity and transparency.
Moreover, the decentralized nature allows participants to access this view always.
This global view is not static; it continuously evolves whenever a new SBOM is registered.
|
|
ICACT20250067 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The architecture of the BC-SBOM is composed of 4 layers, each serving a distinct function within the system.
The service layer provides essential services for registering SBOMs, querying dependency information, and propagating vulnerability alerts.
The smart contract layer manages dependencies between software components and constructs a global view using smart contracts.
The data repository layer stores and shares both SBOMs and DID documents.
The blockchain network layer ensures the integrity and transparency of transactions in a decentralized manner.
|
|
ICACT20250067 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Let us now introduce the BC-SBOM, our Blockchain-based SBOM system. This system leverages the characteristics of blockchain technology to create a highly trustworthy and automated SBOM management system.
Firstly, the BC-SBOM system ensures the easy and secure sharing of registered SBOMs among participants. Each participant can access the origin and related information about software components transparently.
Secondly, BC-SBOM offers a global view of all software dependencies. This global view is particularly important as it allows participants to efficiently query comprehensive dependency information for specific components.
Lastly, our system provides fast propagation of vulnerability alerts. When a new vulnerability is detected in any component of the software, our system rapidly notifies alert messages to all participants using the affected software.
|
|
ICACT20250067 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Now we will explore Decentralized Identifiers, commonly referred to as DID.
DID allows users to control their identity independently without centralized authority.
, and it enhances personal data protection and, ensures high reliability.
As illustrated in the diagram on this slide, DID is resolved to its corresponding DID document through a decentralized system. This mechanism is part of the W3C Decentralized Identifiers standard.
And blockchain can be used as a decentralized, verifiable data repository for DID document.
|
|
ICACT20250067 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Blockchain is a decentralized trust platform characterized by several fundamental features.
First, let’s consider the Decentralized Ledger. Blockchain is designed to store transactions across a network of computers, making each block linked to the previous block. This structure complicates data tampering and enhances both transparency and security. Unlike traditional systems, the decentralized nature of blockchain solves the problem of single points of failure.
Next, we have Smart Contracts. These are self-executing contracts written into code. When predetermined conditions are met, the contracts automatically execute the agreed codes. This automation not only ensures reliability and transparency but also eliminates the need for intermediaries, thus reducing both transaction costs and execution time.
Lastly, Blockchain technology can greatly improve the management of supply chains by enhancing transparency, integrity, and reliability—not only in traditional sectors but also specifically in the software supply chain.
|
|
ICACT20250067 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
However, current SBOM systems have several limitations.
First, let’s talk about Single Points of Failure. Most existing SBOM systems rely heavily on centralized servers or databases. This centralization can create significant vulnerabilities, as any failure of these servers will stop the entire system. This risk is a major concern for the integrity and availability of SBOM data.
Next, we have Update Complexity. Centralized SBOM systems often struggle with updating information in real-time as software components change.
Lastly, Lack of Transparency. Centralization also means that data accessibility and management transparency are often restricted. This lack of transparency makes it difficult for all stakeholders to verify and trust the SBOM data.
These limitations highlight why we are seeking to leverage blockchain technology to address these challenges.
|
|
ICACT20250067 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Let's discuss why SBOM is necessary in today’s software landscape.
First, Transparency. SBOMs ensure the transparency of software components by clarifying the origin and attributes of each component. This transparency ensures that all components are verifiable and nothing is hidden.
Next, Enhanced Security. SBOMs are crucial for security. They allow organizations to quickly identify vulnerabilities to minimize risk by applying necessary patches.
Then, we have Regulatory Compliance. As regulations around software security are tighten, SBOMs play an important role in ensuring compliance.
Lastly, License Management. SBOMs help organizations avoid legal pitfalls related to software licensing, ensuring that they are not violating intellectual property rights.
|
|
ICACT20250067 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
let's start by understanding the core concept of a Software Bill of Materials, or SBOM.
An SBOM provides a detailed and comprehensive list of all components in a software product.
This is the foundation for identifying the software source, version, and license information which are critical data for managing software lifecycle and compliance.
On the right side of the slide, you can see an SBOM example in SPDX format.
|
|
ICACT20250067 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Hello everyone.
My name is Professor Heeyoul Kim from Kyonggi University in Korea.
Today, I will be presenting our work on the Blockchain-based Software Bill of Materials Management System.
|
