摘要
随着计算机技术的快速发展,软件已成为人们生活中不可或缺的一部分,并且软件安全已经成为一个备受关注的焦点议题。同时,软件供应链多次受到攻击。为了深入了解软件的安全及其组成成分,产生了软件物料清单这一关键概念。软件物料清单的目的是提供软件供应链的透明度和可管理性。通过明确列出软件中使用的组件和其相关信息,软件物料清单可以帮助企业追踪和管理软件的来源、版本、许可证信息等。这有助于降低供应链风险,确保软件的合规性,并提高安全性。本文从软件物料清单国内外现状到其特点和应用做出了介绍,同时详细说明了软件物料清单在软件供应链安全中的使用,并以此为切入点,通过对工具的对比,提出了未来软件物料清单的发展方向并表明了软件物料清单的重要性。
With the rapid development of computer technology,software has become an indispensable part of people's lives,and software security has become a topic of great concern.At the same time,the software supply chain has been attacked many times.In order to gain a deeper understanding of software security and its components,the key concept of a software bill of materials has emerged,which aims to provide transparency and manageability of the software supply chain.By clearly listing the components used in software and their associated information,the software bill of materials helps organizations track and manage software sources,versions,license information,and more.This helps reduce supply chain risks,ensure software compliance,and improve security.This paper makes an introduction from the current status of software bill of materials at home and abroad to its characteristics and applications,while detailing the use of software bill of materials in software supply chain security,and using this as an entry point to the future direction of software bill of materials and the importance of software bill of materials through the comparison of tools.
作者
牟金帅
刘冬梅
赵宇红
MU Jinshuai;LIU Dongmei;ZHAO Yuhong(School of Information Engineering,Inner Mongolia University of Science and Technology,Baotou 014010,China)
出处
《北方工业大学学报》
2024年第1期37-49,共13页
Journal of North China University of Technology
基金
内蒙古自治区重点研发和成果转化计划项目(2022YFSH0044)。
关键词
软件物料清单
软件供应链
软件安全
供应链风险管理
software bill of materials
software supply chain
software security
supply chain risk manage⁃ment
