Distributed Entropy System for Virtualized Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized environments face challenges in generating high-quality entropy for cryptographic purposes due to lack of reliable randomness sources, making them vulnerable to attacks by predicting pseudorandom number generators (PRNG) seeds, especially in highly virtualized settings where entropy sources are obscured and predictable.
Innovation Solution
A distributed entropy system is implemented within virtualized environments, aggregating entropy from multiple sources, including system events and OS-visible sources, and using mechanisms like hashing and whitening to create a robust and tamper-resistant entropy pool, which is then used to re-seed PRNGs continuously, preventing attackers from determining PRNG attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtual machines virtualize hardware resources, then resource isolation and flexibility are improved, but entropy sources are obscured and predictability increases
Solution Approach 1:
The patent introduces a hardware entropy source as an intermediary component that provides true randomness to the virtualized environment. This hardware entropy source acts as a mediator between the physical hardware and the virtual machines, delivering unpredictable entropy values that are then used to seed PRNGs in each VM, thereby resolving the entropy quality issue while maintaining virtualization benefits
Solution Approach 2:
The system segments the entropy provision by allocating dedicated entropy values to each virtual machine from the hardware entropy source. Each VM receives its own seeded PRNG initialized with unique entropy, creating independent random number generation streams that maintain security isolation while enabling flexible virtualization
2Adaptability or versatility
If emulated hardware is used in virtual machines, then hardware compatibility is improved, but randomness is removed and predictability increases
Solution Approach 1:
The patent replaces the mechanical/emulated hardware random number generation with a software-based PRNG that is seeded from hardware entropy sources. Instead of relying on emulated hardware timers or random number generators that are predictable, the system uses cryptographic PRNGs initialized with true hardware entropy, substituting the predictable mechanical system with a cryptographically secure software solution
3Ease of manufacture
If PRNG is used for cryptographic key generation, then cryptographic operations are enabled, but security is compromised when PRNG seed is predictable
Solution Approach 1:
The patent applies preliminary action by pre-seeding the PRNG with high-quality entropy from hardware sources before cryptographic operations begin. This pre-initialization with unpredictable entropy values ensures that even if the PRNG state is later compromised, the initial seed remains unpredictable, maintaining cryptographic security while enabling standard PRNG-based cryptographic operations
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is disclosed. The method includes receiving, by a computer node in a network including a plurality of computer nodes, a plurality of data values from the plurality of computer nodes. Each computer node can create a data value based on a time that the computer node in the plurality of computer nodes takes to perform a function. The computer node can then provide the data values or derivatives thereof as random values to an entropy pool of random values. The computer node can then select a random value from the entropy pool and initiate use of the random value in an operation.