SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties

Chinenye Okafor,Taylor R. Schorlemmer,Santiago Torres-Arias,James C. Davis

2024-06-14

Abstract:This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered supply chain security techniques

Cryptography and Security,Software Engineering

What problem does this paper attempt to address?

This paper mainly discusses the security issues of software supply chain. The author analyzes the four stages of software supply chain attacks and proposes three key attributes for ensuring supply chain security: transparency, effectiveness, and isolation. The paper describes current security methods and maps these methods to the proposed security attributes, including research ideas and practical supply chain cases. The author also discusses the advantages and disadvantages of existing methods compared to known attacks and provides detailed introductions to various security frameworks for ensuring software supply chain security. Finally, the paper points out the potential knowledge gaps in participant- and operation-centric supply chain security technologies.

The problems that the paper seeks to address are:
1. How to systematically understand and match existing software supply chain security mechanisms with different architectures and applications?
2. How to enhance the security of software supply chain through design patterns to prevent malicious attacks and ensure network security?
3. How to fill the knowledge gaps in software supply chain security technology and establish a comprehensive, systematic framework for better understanding and implementing security measures by system integrators and designers?

The author aims to provide a comprehensive research and guidance framework for the security design of software supply chain by analyzing existing security practices, attack patterns, and security attributes.