TrustBOM: A Scalable Architecture for Confidentiality-Preserving SBOMs Across Organizations

2026-09-18

AI Summary

本文提出TrustBOM架构，利用零知识非成员证明解决跨组织间软件物料清单(SBOM)的保密性问题，同时保证了在大规模企业环境中的高效运行。

Abstract

Software Bills of Materials (SBOMs) have emerged as a key mechanism for software supply chain governance in enterprise architectures. However, their adoption across organizations remains limited due to concerns about exposing sensitive dependency information. To address this limitation, we propose TrustBOM, a scalable architecture for confidentiality-preserving SBOMs integrated into enterprise CI/CD workflows. TrustBOM enables software providers to attest that specific vulnerabilities or restricted licenses are absent from their software without revealing the underlying dependency graph. This is achieved using zero-knowledge non-membership proofs, which are applied selectively based on consumer-defined policy constraints. The architecture ensures that proof generation scales linearly with the number of asserted constraints rather than with the size of the SBOM, enabling efficient operation in large-scale enterprise environments. Empirical evaluation demonstrates linear performance, with an average proof generation time of 0.9 seconds per constraint on commodity hardware, indicating the feasibility of deployment in enterprise platform ecosystems.

Problem

• SBOMs
• confidentiality
• software supply chain governance

Innovation

• zero-knowledge non-membership proofs
• confidentiality-preserving SBOMs
• scalable architecture
• CI/CD workflows