TrustBOM protects software supply info without revealing details
TrustBOM: A Scalable Architecture for Confidentiality-Preserving SBOMs Across Organizations
Cryptography and SecurityDistributed, Parallel, and Cluster Computing
Summary
Sharing detailed software building blocks between companies can leak secret information, so many avoid it. The authors introduce TrustBOM, a way to prove that software avoids certain problems without showing the full list of parts. This proof is quick and works even when the software is very large. Their tests show the method is practical for big companies to use.
What this means in practice
- •For enterprise software teams: Enable software providers to prove absence of vulnerabilities and restricted licenses without exposing sensitive dependency details during development.
- •For cloud service providers: Offer confidentiality-preserving compliance checks for customer software supply chains without requiring full disclosure of their components.$Commercial implications: This paper enables cloud providers to build services that verify software safety while protecting customer-sensitive supply chain details.
Authors
Van Thang Nguyen, Frederic Rupprecht, Tom Lawrence, Lucca Di Benedetto, Sören Schubert, Amor Rezgui, Sebastian Werner, Maria C. Borges, Stefan Tai
Abstract
Software Bills of Materials (SBOMs) have emerged as a key mechanism for software supply chain governance in enterprise architectures. However, their adoption across organizations remains limited due to concerns about exposing sensitive dependency information. To address this limitation, we propose TrustBOM, a scalable architecture for confidentiality-preserving SBOMs integrated into enterprise CI/CD workflows. TrustBOM enables software providers to attest that specific vulnerabilities or restricted licenses are absent from their software without revealing the underlying dependency graph. This is achieved using zero-knowledge non-membership proofs, which are applied selectively based on consumer-defined policy constraints. The architecture ensures that proof generation scales linearly with the number of asserted constraints rather than with the size of the SBOM, enabling efficient operation in large-scale enterprise environments. Empirical evaluation demonstrates linear performance, with an average proof generation time of 0.9 seconds per constraint on commodity hardware, indicating the feasibility of deployment in enterprise platform ecosystems.