Change-Tolerant Asset Identifier via Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating system identifiers in computing environments are not tolerant of changes in computing components, making them vulnerable to attacks and unsuitable for scenarios where component updates are common, and they often require storing sensitive asset parameters, which is a security risk.
Innovation Solution
A change-tolerant method using an (M-1, N) secret sharing scheme that generates a fingerprint by decrypting shares and using all subsets of M-1 shares to produce candidate identifiers, with the most prevalent one being the final identifier, allowing for valid system identification even with allowable changes in asset parameters without storing original values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If basic fingerprinting algorithms are used to generate system identifiers, then the identifier generation is simple and deterministic, but the identifier changes when computing components change, making it vulnerable to attacks and unsuitable for environments with component updates
Solution Approach 1:
The patent divides the system identifier generation into multiple discrete shares, where each share corresponds to a specific computing component. Instead of treating the system as a whole, the identifier is segmented into N shares, and only M-1 shares are needed to reconstruct the original identifier. This segmentation allows the system to tolerate changes in individual components while maintaining identifier consistency.
Solution Approach 2:
The patent performs preliminary encoding of the original system identifier into multiple shares before distribution to different computing components. This preliminary action ensures that when components change, the remaining shares can still reconstruct the original identifier without requiring real-time analysis or adaptation.
2Adaptability or versatility
If recorded device identifiers are stored to enable change-tolerant fingerprinting, then the system can accommodate component updates, but the stored identifiers become an attack vector vulnerable to malicious exploitation
Solution Approach 1:
The patent segments the original identifier into multiple distributed shares stored across different computing components. No single component or external attacker can access the complete identifier by obtaining just one share. This segmentation eliminates the centralized attack vector while maintaining change tolerance, as the system can reconstruct the identifier from any M-1 shares.
Solution Approach 2:
The patent introduces secret sharing as an intermediary mechanism between the original identifier and its storage/distribution. Instead of storing the identifier directly, the system uses secret sharing to transform it into multiple shares that require collaboration to reconstruct. This intermediary layer protects against attacks while enabling change tolerance.
3Adaptability or versatility
If M of N fingerprinting allows too many assets to change without fingerprint change, then change tolerance is high, but the fingerprint loses its identifying power and becomes meaningless
Solution Approach 1:
The patent changes the fundamental parameter from allowing M out of N components to change (M of N) to requiring M-1 out of N shares to reconstruct the identifier. This parameter change ensures that the threshold for maintaining identifier validity is precisely controlled, balancing change tolerance with identifier uniqueness and meaningfulness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A change-tolerant method of generating a fingerprint of a computing environment based on asset parameters associated components of the computing environment. Asset parameters are grouped into multiple subsets based on characteristics of the components. A share is generated for each asset parameter of the category to produce a plurality of shares. A secret sharing algorithm is applied to the subsets to generate a plurality of candidate identifiers corresponding to the plurality of subsets of shares. A candidate identifier is selected from the plurality of candidate identifiers as a final identifier for each category based at least in part on a frequency of occurrence of that candidate identifier. The final identifiers are combined into a fingerprint corresponding to the computing environment, wherein the fingerprint is provides verification of the plurality of components without requiring individual verification of any shares in the plurality of shares.