Entropy Pool Management for Virtual Machine Random Number Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Proving randomness of entropy from internal sources in virtual machine environments is difficult to ensure compliance with security standards, such as EAL4, and internal sources alone may not provide sufficient randomness for reliable random number generation.
Innovation Solution
Combining entropy from certified external sources with internal sources to enhance overall randomness, using a daemon component that manages entropy pools and caches entropy from both sources, ensuring compliance with security standards like NIST SP 800-90C and AIS 20/31.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entropy is obtained only from internal sources (peripherals, CPU, memory), then the entropy pool can be populated without external dependencies, but proving randomness compliance with security standards becomes difficult and sufficient randomness cannot be ensured
Solution Approach 1:
The patent combines multiple entropy sources including internal sources (peripherals, CPU, memory) and external sources (hardware RNG devices, trusted platform modules) into a unified entropy pool. This merging allows the system to leverage the compliance-certified randomness from external sources while maintaining the autonomy of internal sources, thereby resolving the contradiction between ensuring randomness compliance and avoiding device complexity.
Solution Approach 2:
The patent introduces an entropy management component that acts as an intermediary between entropy sources and the random number generator. This mediator collects, evaluates, and combines entropy from multiple sources, automatically selecting and mixing entropy based on compliance requirements. The intermediary simplifies the complexity by providing a unified interface while ensuring security standards compliance through systematic entropy management.
2Reliability
If entropy from external sources is used, then sufficient randomness for reliable random number generation can be ensured, but the system becomes dependent on external entropy sources
Solution Approach 1:
The patent implements a dynamic entropy management system that adaptively selects and combines entropy from internal and external sources based on availability, quality, and compliance requirements. The system can dynamically adjust the proportion of external versus internal entropy used, ensuring reliable random number generation when external sources are available while maintaining system independence by falling back to internal sources when external sources are unavailable or insufficient.
3Measurement precision
If multiple entropy sources are combined to improve randomness, then the quality of entropy increases, but the complexity of managing and proving compliance increases
Solution Approach 1:
The patent implements feedback mechanisms that continuously monitor the quality and compliance status of entropy from multiple sources. The entropy management component receives feedback on entropy quality metrics and compliance status, automatically adjusting the selection and combination of entropy sources. This feedback-driven approach simplifies compliance management by providing automated evaluation and selection, while ensuring high entropy quality through continuous monitoring and adaptive mixing of multiple sources.
Data Source
AI summary
To populate an entropy pool with entropy from external sources, a computer system transmits, to multiple entropy sources, a request to receive entropy. At least one of the multiple entropy sources is an external source that is external and operatively connected to the computer system. The computer system receives entropy from the external source. The computer system stores the entropy received from the external source in an entropy storage medium. The computer system receives, from a client computer system, a request for entropy to be used by the client computer system to implement a random number generation algorithm. In response to receiving the request, the computer system provides a portion of the stored entropy. The portion of the stored entropy provided in response to receiving the request includes the entropy received from the external source.