# Distributed Software Build Assurance for Software Supply Chain Integrity
## 6 Experimental Analyses
### Authority Delivering References: Our Scheme vs. Centralized Server Approach  
As described in Section 4.5, our scheme utilizing blockchain enables the networking and distribution of the reference information of \(p^{\prime}\) offline, in contrast to the centralized server approach which relies on a server and the online networking and sharing of \(p^{\prime}\). The proof verification process online (more specifically, after the software download/build and the proof generation for \(p\)) operates very differently between our scheme vs. the centralized server approach. In this section, we focus on the online software build assurance verification process. We also analyze how the efficiency of the verification affects the bandwidth of the assurance operations (the number/rate of assurances supported by our scheme vs. the centralized server approach).  
**Online Proof Verification For Our Scheme vs. Centralized Server Approach:** Because our scheme only involves computing while the centralized server approach involves both networking and computing (computing and verification based on the communication receiving results of \(p^{\prime}\)), our scheme is significantly more efficient in the online proof verification operation. Figure 5 shows the empirical measurement distribution in CDF and identifies the average values in dotted vertical lines. The proof verification takes 0.4254 ms, while the centralized server approach takes at least 91.42 times more, depending on the locations. Among the distinct remote servers serving as the authority to our scheme, the Iowa server is the quickest at 38.89 ms (91.42 times slower than our use of blockchain for the authority) and the London server is 370.9 (871.9 times slower). In general, the remote servers in the US nation (the user is also in the US) perform much better than the ones outside, because they go through a smaller number of distinct internet service providers (ISPs). In our experiments, our scheme based on the blockchain-authority performs two to three orders of magnitude quicker than having a centralized, remote authority.  
**Assurance Bandwidth For Our Scheme vs. Centralized Server Approach:** Using blockchain as the authority for our scheme as opposed to the centralized server approach also provides significant improvement in the rate support. We define the bandwidth here to be the number of assurance resolutions that can be supported using our scheme. We experimented using 1000 requests per second and observed how many of those requests were resolved, including the final verification. As shown in Figure 6, if using the blockchain as the authority, our scheme can support 905.9 assurance resolutions per second. If using a remote centralized server as the authority for our scheme, the bandwidth is limited to between 17.90 (London with the worst performance) and 63.78 (Iowa with the best performance). Comparing between the distinct remote-server simulations, similarly to the above latency measurements, the remote servers in the US perform much better than the authority servers outside.  
Figure 5: The proof verification time between our scheme using distributed blockchain vs. centralized remote servers.