A blockchain‐based and microservices‐architected software composition analysis system
Xin Zhou,Jinwei Xu,Xiaokang Li,Lingli Cao,Lingjie Li,Yanze Wang,Shanshan Li,Hui Liu
DOI: https://doi.org/10.1002/smr.2675
2024-06-13
Journal of Software Evolution and Process
Abstract:This is a Software Composition Analysis (SCA) system based on blockchain technology and microservices architecture. In this system, blockchain serves as the core data repository to ensure data security and privacy. Microservices, decoupling smart contracts and consensus nodes, form the infrastructure to improve system resilience and scalability. SCA performs the core function, which generates and analyzes Software Bill of Material (SBOM) for vulnerability management and compliance verification, reducing upstream software supply chain risks. "Shift To Left" is the cornerstone of the successful implementation of DevSecOps. By testing projects for vulnerabilities in the early stages of development, teams can save overall costs before security issues reach the build phase. As one of the popular practices in "Shift To Left," the Software Composition Analysis (SCA) system aims to leverage the Software Bill of Materials (SBOM) to enhance software supply chain security. However, the SBOM lacks mature generation and distribution mechanisms, requiring incentive measures to drive industry consensus. Additionally, the data and tools associated with the SBOM lack effective record‐keeping and monitoring, making it challenging to ensure data integrity and tool security. Traditional SCA systems treat SBOM as a regular data format for external service provision, yet fail to solve problems such as lack of shared platforms, inability to guarantee data integrity and tool security, as well as issues with poor interoperation compatibility. This paper introduces blockchain technology into the SCA system, utilizing smart contracts to provide core SBOM tool services and microservices to improve the operational efficiency of smart contract deployment and maintenance. The proposed SCA system effectively provides a shared platform for SBOM with reliable data integrity, guaranteed tool security, and good interoperability.
computer science, software engineering