Blockchain-based state verifications of software component vulnerability database for software products
A technique includes determining, by a computer, entries of a software vulnerability database that is associated with a plurality of components associated with a release of a software product. The technique includes determining, by the computer, a block of a blockchain representing a vulnerability state of the plurality of components; and associating, by the computer, the block of the blockchain with the product release.
1. A method comprising:
determining, by a processor of a computer, an inventory of components that are contained in a particular version of a software product;
identifying, by the processor, vulnerable components of the particular version of the software product that have vulnerability risks, by identifying entries of a software vulnerability database that correspond to any components in the inventory of components;
generating, by the processor, a block of a database blockchain representing a state of the software vulnerability database at a time when the vulnerable components were identified, wherein each block of the database blockchain represents a different state of the software vulnerability database; and
generating, by the processor, a validation stamp containing a first reference to an application block that contains the inventory of components of the particular version of the software product and a second reference to the block of the database blockchain that represents the state of the software vulnerability database at the time the vulnerable components were identified.
2. The method of claim 1 , wherein the application block is one block of an application blockchain, each block of the application blockchain representing a different version of the software product.
3. The method of claim 1 , wherein the second reference comprises a blockchain page number.
4. The method of claim 1 , wherein the validation stamp further comprises data representing a hash of the software product.
5. The method of claim 1 , wherein the validation stamp further comprises data representing a name of the software product.
6. The method of claim 1 , wherein the validation stamp further comprises data representing identifiers for the inventory of components.
7. The method of claim 1 , wherein the validation stamp further comprises data representing identifiers for the vulnerable components appearing in the block of the database blockchain.
8. The method of claim 1 , wherein the database blockchain comprises a master database blockchain, and the master database blockchain comprises a plurality of component vulnerability entry blocks representing corresponding states of the entries of the software vulnerability database.
9. The method of claim 8 , wherein a given component vulnerability entry blockchain represents an entry of the software vulnerability database and changes to the entry.
10. The method of claim 8 , wherein the plurality of component vulnerability entry blocks are associated with a plurality of security reporters.
11. The method of claim 8 , wherein the master database blockchain is signed by a central authority.
12. The method of claim 11 , wherein the central authority comprises a single entity or a plurality of entities.
13. An apparatus comprising:
at least one processor; and
a memory to store instructions that, when executed by the at least one processor, cause the at least one processor to:
determine an inventory of components that are contained in a particular version of a software product;
identify vulnerable components of the particular version of the software product that have vulnerability risks, by identifying entries of a vulnerability database that correspond to any components in the inventory of components;
generate a block of a database blockchain representing a state of the vulnerability database at a time when the vulnerable components were identified, wherein each block of the database blockchain represents a different state of the vulnerability database; and
generate a validation stamp for the particular version of the software product, wherein the validation stamp contains a first reference to the block of the database blockchain that represents the state of the vulnerability database at the time when the vulnerable components were identified and a second reference to an application block that contains the inventory of components of the particular version of the software product.
14. The apparatus of claim 13 , wherein the vulnerable components comprise third party components of the software product.
15. The apparatus of claim 13 , wherein the database blockchain comprises a master blockchain, and the master blockchain comprises a plurality of component vulnerability entry blockchains representing corresponding states of the entries of the vulnerability database.
16. A non-transitory machine readable storage medium storing instructions that, when executed by a machine, cause the machine to:
determine an inventory of components that are contained in a particular version of a software product;
identify vulnerable components of the particular version of the software product that have vulnerability risks, by identifying entries of a software vulnerability database that correspond to any components in the inventory of components;
generate a block of a database blockchain representing a state of the software vulnerability database at a time when the vulnerable components were identified, wherein each block of the database blockchain represents a different state of the software vulnerability database; and
generate a validation stamp containing a first reference to an application block that contains the inventory of components of the particular version of the software product and a second reference to the block of the database blockchain that represents the state of the software vulnerability database at the time the vulnerable components were identified.
17. The non-transitory machine readable storage medium of claim 16 , wherein the application block is one block of an application blockchain, each block of the application blockchain representing a different version of the software product.
18. The non-transitory machine readable storage medium of claim 16 , wherein the second reference comprises a page number of the block of the database blockchain.
19. The non-transitory machine readable storage medium of claim 16 , wherein the database blockchain comprises a master blockchain, and the master blockchain comprises a plurality of component vulnerability entry blockchains representing corresponding states of the entries of the software vulnerability database.
20. The non-transitory machine readable storage medium of claim 19 , wherein a given component vulnerability entry blockchain comprises a plurality of component vulnerability entry blocks representing an entry of the software vulnerability database and changes to the entry.