Dynamic Cryptographic Module Selection for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic security management systems, such as IBM BigFix Platform, lack the ability to selectively enforce mutually exclusive cryptographic security policies like FIPS 140-2 and ASLR, leading to vulnerabilities due to the need for both modules to be built with a fixed base address and containing unnecessary code, which is not officially validated by NIST, and cannot support arbitrary cryptographic modules for diverse network security contexts.
Innovation Solution
A cryptographic security policy management system that allows for the dynamic selection and enforcement of arbitrary cryptographic security modules across a network, enabling the choice between FIPS 140-2 validated and ASLR capable modules, with unique symbols and configurations, ensuring secure operation by loading modules at different addresses and removing the need for unnecessary code and validation processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If both FIPS 140-2 and ASLR cryptographic modules are built with a fixed base address, then both modules can be included in the system, but security vulnerabilities arise and NIST validation cannot be obtained
Solution Approach 1:
The system dynamically selects which cryptographic module (FIPS 140-2 or ASLR) to load based on runtime configuration rather than statically linking both modules. This dynamic selection allows the system to adapt to different security requirements while maintaining a single executable, resolving the contradiction between supporting multiple policies and achieving validation for one specific policy.
Solution Approach 2:
The cryptographic functionality is segmented into separate loadable modules rather than being compiled into a single binary. This allows the system to load only the required cryptographic module at runtime, enabling support for multiple cryptographic policies while maintaining validation for the specific module that is loaded and configured.
2Adaptability or versatility
If cryptographic modules contain all necessary code for multiple security policies, then versatility is improved, but code bloat and unnecessary validation processes occur
Solution Approach 1:
A universal cryptographic framework is implemented that can work with different cryptographic modules through a common interface. The framework itself is policy-agnostic and does not contain policy-specific code, while the actual cryptographic functionality is provided by separate modules that are loaded based on the required security policy, achieving versatility without code bloat.
Solution Approach 2:
Policy-specific cryptographic code is extracted from the main executable and placed into separate loadable modules. The main executable contains only the universal framework code, which is minimal and does not include unnecessary validation processes for policies that are not being used. This extraction reduces code size and eliminates unnecessary validation requirements.
3Ease of operation
If a single cryptographic module is enforced across the network, then management simplicity is improved, but the ability to support diverse network security contexts is reduced
Solution Approach 1:
The system uses dynamic configuration files that can be centrally managed and distributed to specify which cryptographic module should be used in different security contexts. This allows centralized management of cryptographic policies while enabling adaptation to diverse security requirements through configuration rather than code changes.
Solution Approach 2:
Configuration files act as an intermediary between the centralized management system and the cryptographic module selection. The management system can specify which module to use in which context through these configuration files, which are then processed by the cryptographic framework to select the appropriate module, achieving both centralized control and contextual adaptability.
4Ease of manufacture
If cryptographic modules are loaded at fixed addresses, then module loading is simplified, but security vulnerabilities increase due to lack of address space layout randomization
Solution Approach 1:
The system dynamically determines the load address of cryptographic modules at runtime rather than using fixed addresses. This can include randomization techniques such as ASLR when the ASLR module is selected, or fixed addresses when the FIPS 140-2 module is selected. The dynamic address selection resolves the contradiction by allowing flexibility in addressing strategies based on the selected module.
Solution Approach 2:
The load address parameter of cryptographic modules is changed from a fixed value to a dynamic value that can be randomized. This parameter change enables security vulnerabilities to be mitigated through address randomization while maintaining the ability to load modules using fixed addresses when required by specific cryptographic standards.
Data Source
AI summary
An embodiment of the invention may include a method, computer program product, and system for securing data. The embodiment may include receiving, by a management program, identification of a selected cryptographic security module. The selected cryptographic security module is graphically selected by an authorized operator via a graphic user interface. The selected cryptographic security module contains unique individual symbols that contain references to functions and is selected from a plurality of mutually exclusive cryptographic security modules. Based on the received identification of the selected cryptographic security module, the embodiment may include generating, by the management program, a global configuration file. The embodiment may include transmitting, by the management program, a notification to an agent program on a client computer. The notification informs the agent program of the generated global configuration file and directs the agent program to enforce the selected cryptographic security module on the client computer.