Anuket Project

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 13 Next »

What:

Dovetail will provide a way to authenticate the integrity for both dovetail tool and report.

With this approach, dovetail generates a digital signature along with the plain-text report . Then the reviewer can use this signature to validate the integrity of the dovetail tool and the report.

Why:

The report in plain-text is vulnerable, can be easily modified during storage and transportation.

Reviewer needs to make sure that the report is generated by a validated tool from the release and its result can not be modified to remove a failure or something like that.

Users do not need to know or learn any details about this procedure.

How:

1.proposal for authenticating of final report :

a. OPNFV generates the key pairs for each release
b. Dovetail uses this key and hash value of the dovetail tool  to build a binary signature tool
c. Users begin to run the dovetail tool, the dovetail tool will generate the report in memory, and then use the signature tool to check the integrity of dovetail tool, then sign the report
d. Dovetail tool saves the report to a report file
e. Users then can upload report and signature to the reviewer
f. Reviewer can get a public key from OPNFV to extract digest from signature
g. Then reviewer can validate the integrity of the report

2. proposal for container security:

Temporary test results in container can be modified as well, we can improve this by following: 

1) the upstream project to do authentication on themselves

2) setup a database, and the database is dedicated for dovetail results, people with no permit can not access the database

3) use the REST API of FUNCTEST/YARDSTICK with SSL to make sure that these results are just existing in secured transportation and saved to db, and then no one can touch them.

  • No labels