SMT: SBOM and Merkle Tree Based Integrity Verification for Serverless Environments

Abstract

Serverless computing environments are vulnerable to software supply chain attacks due to their heavy reliance on external libraries. However, existing integrity verification methods are centered on runtime execution logs, which limits their ability to directly detect tampering with function code and dependencies. In this paper, we propose an integrity verification framework that combines a Software Bill of Materials (SBOM) with a Merkle Tree, hereafter referred to as an SMT scheme. By utilizing SBOMs within the CI/CD (Continuous Integration/Continuous Delivery) pipeline, the SMT scheme establishes a trusted baseline at deployment time. Furthermore, it verifies both code and runtime integrity by correlating runtime execution logs with corresponding SBOM hash values. Experimental results demonstrate that the SMT scheme effectively detects code and dependency tampering attacks while incurring only a modest overhead of approximately 5–10% relative to existing method.