AI 中文总结
针对SBOM跨组织采用中敏感依赖信息暴露的担忧，提出TrustBOM架构，利用零知识非成员证明实现保密性，证明生成时间随约束数线性扩展，平均每约束0.9秒，适用于企业CI/CD环境。
AI 中文摘要
软件物料清单（SBOM）已成为企业架构中软件供应链治理的关键机制。然而，由于担心敏感依赖信息的暴露，其跨组织采用仍然有限。为解决这一限制，我们提出了TrustBOM，一种集成到企业CI/CD工作流中的保密性SBOM可扩展架构。TrustBOM使软件提供商能够证明其软件中不存在特定漏洞或受限许可证，而无需揭示底层依赖图。这是通过零知识非成员证明实现的，该证明根据消费者定义的策略约束选择性应用。该架构确保证明生成时间随断言约束的数量线性扩展，而非随SBOM的大小扩展，从而在大规模企业环境中实现高效运行。实证评估展示了线性性能，在商品硬件上每个约束的平均证明生成时间为0.9秒，表明在企业平台生态系统中部署的可行性。
英文摘要
Software Bills of Materials (SBOMs) have emerged as a key mechanism for software supply chain governance in enterprise architectures. However, their adoption across organizations remains limited due to concerns about exposing sensitive dependency information. To address this limitation, we propose TrustBOM, a scalable architecture for confidentiality-preserving SBOMs integrated into enterprise CI/CD workflows. TrustBOM enables software providers to attest that specific vulnerabilities or restricted licenses are absent from their software without revealing the underlying dependency graph. This is achieved using zero-knowledge non-membership proofs, which are applied selectively based on consumer-defined policy constraints. The architecture ensures that proof generation scales linearly with the number of asserted constraints rather than with the size of the SBOM, enabling efficient operation in large-scale enterprise environments. Empirical evaluation demonstrates linear performance, with an average proof generation time of 0.9 seconds per constraint on commodity hardware, indicating the feasibility of deployment in enterprise platform ecosystems.
CommentsThis work has been accepted to the 30th International Conference on Enterprise Design, Operations, and Computing (EDOC 2026)
