VeriSBOM：通过零知识证明实现安全且可验证的SBOM共享
VeriSBOM: Secure and Verifiable SBOM Sharing Via Zero-Knowledge Proofs
AI总结：
VeriSBOM通过零知识证明实现安全且可验证的SBOM共享，保护知识产权并确保合规性。
摘要：
软件物料清单（SBOM）是软件供应链透明性的重要组成部分；它是一个结构化的组件、依赖关系和相关元数据的清单。然而，SBOM通常包含敏感信息，组织不愿意向任何人完整披露，主要有两个担忧：技术风险源于暴露专有依赖关系或未修补的漏洞，以及商业风险源于暴露架构策略。因此，提供明文SBOM可能导致公司知识产权的破坏。为了解决这个问题，我们提出了VeriSBOM，一种无信任、选择性披露的SBOM框架，通过零知识证明提供SBOM的加密可验证性。在VeriSBOM中，第三方可以验证特定关于交付软件的陈述。相应地，VeriSBOM允许独立第三方验证软件是否包含由官方包管理器分发的真正的依赖关系，并且相同的依赖关系是否满足严格政策约束，例如没有漏洞依赖关系或符合特定许可证模型。VeriSBOM利用可扩展的向量承诺方案以及基于折叠的证明聚合，产生简短的零知识证明，以证明安全性和合规性属性，同时保持保密性。至关重要的是，验证过程不需要对SBOM发布者之外的信任，仅需底层原语的正确性，第三方可以独立地将证明与公开的加密承诺进行对比。我们实现了VeriSBOM，分析了其安全性，并在现实世界包注册表上评估了其性能。结果表明，我们的方法能够实现可扩展、隐私保护和可验证的SBOM共享和验证。
英文摘要：
A Software Bill of Materials (SBOM) is a key component for the transparency of software supply chain; it is a structured inventory of the components, dependencies, and associated metadata of a software artifact. However, an SBOM often contain sensitive information that organizations are unwilling to disclose in full to anyone, for two main concerns: technological risks deriving from exposing proprietary dependencies or unpatched vulnerabilities, and business risks, deriving from exposing architectural strategies. Therefore, delivering a plaintext SBOM may result in the disruption of the intellectual property of a company. To address this, we present VeriSBOM, a trustless, selectively disclosed SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs. Within VeriSBOM, third parties can validate specific statements about a delivered software. Respectively, VeriSBOM allows independent third parties to verify if a software contains authentic dependencies distributed by official package managers and that the same dependencies satisfy rigorous policy constraints such as the absence of vulnerable dependencies or the adherence with specific licenses models. VeriSBOM leverages a scalable vector commitment scheme together with folding-based proof aggregation to produce succinct zero-knowledge proofs that attest to security and compliance properties while preserving confidentiality. Crucially, the verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We implement VeriSBOM, analyze its security, and evaluate its performance on real-world package registries. The results show that our method enables scalable, privacy-preserving, and verifiable SBOM sharing and validation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
