Verifying integrity and secure operations of cloud-based software services
A blockchain-enabled network and application service mesh network architecture including a network service mesh network that includes a plurality of network service domains configured to communicate with each other, each network service domain including a plurality of network service endpoints configured to communicate with a network service client, and a network service manager that broadcasts the availability of the endpoints to network service clients. The architecture further includes an application service mesh network that includes a plurality of applications configured to communicate with each other and a network service domain. A plurality of smart contracts comprising network slicing information from the network service mesh network and the application service mesh network are recorded to a blockchain network.
1. A method for creating a build product, verifying the integrity of the build product and securely operating network slices from the build product comprising:
receiving a build request from a request source comprising a list of one or more packages and an application source;
consuming, by a build tool, one or more build tokens deployed on a blockchain network responsive to receiving the build request; and
sending a notification to the request source indicating the consuming of the one or more build tokens.
2. The method of claim 1 wherein consuming one or more build tokens comprises:
identifying a user associated with the build request;
accessing a build token smart contract deployed on the blockchain network associated with the user; and
deducting the one or more build tokens from the build token smart contract associated with the user.
3. The method of claim 1 further comprising:
receiving a hash value for each package of the one or more packages, defining a received hash value for each package;
downloading the one or more packages identified in the list from a package repository, defining retrieved packages; and
hashing the retrieved packages to generate a hash value for each retrieved package, defining a generated hash value for each package of the retrieved packages; and
comparing the received hash value for each package to the generated hash value for the same package.
4. The method of claim 3 wherein the package repository comprises a plurality of third-party packages.
5. The method of claim 1 wherein the build product is one of a container image and an API.
6. The method of claim 1 further comprising:
receiving from the request source a build product, the one or more packages being an input for generating the build products, at a token verification server;
consuming one or more integrity tokens deployed on the blockchain network responsive to receiving the build product;
verifying the integrity of the build product;
storing the build product in a build product repository;
consuming, by a token orchestrator module, one or more operation tokens; and
creating, at the token orchestrator module, a network slice using each of the build product in the build product repository and a slice template.
7. The method of claim 6 wherein the consuming one or more integrity tokens comprises:
identifying a user associated with the build request;
accessing an integrity token smart contract deployed on the blockchain network associated with the user; and
deducting the one or more integrity tokens from the integrity token smart contract associated with the user.
8. The method of claim 6 wherein the consuming one or more operation tokens comprises:
identifying a user associated with the build request;
accessing an operation token smart contract deployed on the blockchain network associated with the user; and
deducting the one or more operation tokens from the operation token smart contract associated with the user.
9. The method of claim 6 wherein the network slice is created on a Kubernetes cluster.
10. The method of claim 6 wherein the slice template defines one or more of pods, services, and deployments provisioned for the network slice.
11. The method of claim 6 wherein the verifying the integrity of the build product comprises comparing the hashes of the packages in the build product with the hashes of the same packages computed on the server.
12. The method of claim 11 wherein the slice template defines one or more of pods, services, and deployments provisioned for the network slice.
13. The method of claim 6 wherein the build product received from the request source is signed by a private key, defining a signed build product, the method further comprising:
receiving a public key registration request comprising a public key;
registering the public key in a public key database; and
verifying the signed build product by decrypting the signed build product with the public key, producing a decrypted build product and a signature; and
storing each of the decrypted build product and the signature.
14. The method of claim 6 wherein each of the build tokens, the integrity tokens, and the operation tokens are a single token type.
15. The method of claim 1 wherein:
the build request is received from a build tool; and
the build tool generates the build request responsive to receiving an application source and the list of one or more packages from a user.
16. The method of claim 1 further comprising:
receiving a build token acquisition request comprising and a wallet address on the blockchain network; and
sending one or more build tokens to the wallet address.
17. A method for verifying integrity and secure operation of cloud-based software services comprising:
receiving from a request source a build product comprising a list of one or more packages and an application source, the one or more verified packages being an input for generating the build products, at a token verification server;
consuming one or more integrity tokens deployed on a blockchain network responsive to receiving the build product;
verifying the integrity of the build product;
storing the build product in a build product repository;
consuming, by a token orchestrator module, one or more operation tokens; and
creating, at the token orchestrator module, a network slice using each of the build product in the build product repository and a slice template.
18. The method of claim 17 wherein the consuming one or more integrity tokens comprises:
identifying a user associated with the build product;
accessing an integrity token smart contract deployed on a blockchain network associated with the user; and
deducting the one or more integrity tokens from the integrity token smart contract associated with the user.
19. The method of claim 17 wherein the consuming one or more operation tokens comprises:
identifying a user associated with the build product;
accessing an operation token smart contract deployed on the blockchain network associated with the user; and
deducting the one or more operation tokens from the operation token smart contract associated with the user.
20. The method of claim 17 wherein the network slice is created on a Kubernetes cluster.
21. The method of claim 17 wherein the verifying the integrity of the build product comprises comparing the hashes of the packages in the build product with the hashes of the same packages computed on the server.
22. A method of building provisioned network slices comprising:
receiving an application source and a package list;
generating a build request comprising the application source and the package list;
sending the build request to a build server; and
receiving a notification indicating consumption of the one or more build tokens responsive to the build request from the build server.
23. The method of claim 22 further comprising:
retrieving each package listed in the package list from a package repository, defining retrieved packages;
hashing the retrieved packages to generate a hash value for each retrieved package, defining a generated hash value for each package of the retrieved packages; and
transmitting the generated hash value for each pack to a verification server.
24. The method of claim 22 further comprising:
sending a registration request to the build server to register a public key;
receiving a plurality of packages from the build server signed by the public key, defining received signed packages;
decrypting the received signed packages, defining decrypted packages;
building an image using the decrypted packages, defining a built image;
signing the built image with a private key that, along with the public key, define a public-private keypair, defining a signed image;
sending the signed image to the build server; and
sending a request to launch a container using the signed image to the build server.
25. The method of claim 22 further comprising:
sending a build token acquisition request to the build server; and
receiving an indication that the one or more build tokens were sent to a wallet deployed on a blockchain network responsive to the build token acquisition request.