Introduction to SWID

Upon installation of software on a device, a unique ISO Software Identification (SWID) tag is generated to act as a digital identifier for that software. The SWID tag is stored locally on the device, while a corresponding record is simultaneously written to the BloSS@M blockchain, creating an immutable and verifiable record of the installation event.

As part of the software leasing workflow, the device must report the generated SWID tag to the blockchain. This process links the installed software to its assigned license and provides verifiable proof that the software is being used in accordance with licensing requirements. When the end user relinquishes the license, the software is required to be removed from the device. During uninstallation, the associated SWID tag is deleted from the device registry, and the blockchain record is updated to reflect that the software is no longer deployed or actively licensed.

By integrating SWID tagging with blockchain-based record keeping, BloSS@M maintains an accurate and auditable inventory of software installations. This approach strengthens license management, deters unauthorized usage, and supports ongoing compliance with software licensing agreements.

Types of SWID Tags

SWID tags are categorized into four types: corpus, primary, patch, and supplemental. Corpus, primary, and patch tags serve as indicators of installed software, while supplemental tags convey ancillary information that is not represented in the other tag categories.

Corpus SWID Tags

These tags assist in verifying the software product and authenticating the organization that distributes it. They can also be utilized by installation tools to ensure the software's integrity and confirm the presence of a valid license before installation.

Primary SWID Tags

After installation, these tags serve to identify and characterize software products. They typically include the product name, a unique tag ID, and metadata about the tag creator. The tag ID can function as a proxy for the software, allowing asset management and inventory tools to identify and report its presence.

Patch SWID Tags

Each patch SWID tag represents a specific software patch. The tag is deployed alongside the patch during installation and contains metadata about the patch itself, rather than the underlying software that receives the update.

Supplemental SWID Tags

These tags are used to associate additional metadata with installed software after deployment. Created by users or software management systems, they may include information such as licensing credentials or contact information. While they can be installed at any stage, modification privileges are restricted to the tag's creator.

Benefits of Utilizing SWIDs

SWID tags provide the following benefits to software creators, publishers, buyers, and users:

  • Indicate the presence of software on a device to aid discovery
  • Provide a product label to support identification
  • Include product details (e.g., name, version) to enable contextualization

A SWID tag document includes structured metadata about a software product, such as its identity, version, creators, distributors, components, and relationships to other software. This information helps asset management and security tools automate software lifecycle activities. SWID helps to automate:

  • Software inventory in software asset management
  • Vulnerability assessments of installed software
  • Detection of missing patches
  • Configuration checklist assessments
  • Software integrity verification
  • Creation of execution and installation whitelists/blacklists
  • Other operational and cybersecurity functions

Vendors often provide tools to manage their own software products, but organizations commonly use multiple tools from different vendors. This fragmented approach can lead to errors, resource constraints, delayed patching, configuration drift, and inefficient license management. To provide a unified view of software assets across the enterprise, organizations can use ISO/IEC 19880-2:2015, which defines Software Identification (SWID) tags. These tags standardize software metadata, enabling more effective tracking, management, and auditing across diverse software environments.

SWID Supporting the SDLC

SWID tags support stakeholders throughout the system development lifecycle (SDLC) in numerous ways. This includes:

  • Continuous and accurate identification of software to be managed
  • Reliable tracking of software changes on devices using consistent identifiers
  • Standardized information exchange between producers and consumers
  • Automated compliance tracking for software licenses and usage
  • Collection of detailed asset data, including what software is deployed and where
  • Identification of all parties involved in installing, licensing, maintaining, and managing software