Entropy Service for Virtualized Cryptographic Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized computing environments face challenges in generating sufficient entropy for cryptographic security, leading to vulnerabilities in secure connections due to the reliance on pseudorandom number generators (PRNGs) which are predictable and susceptible to attacks, especially when hardware-based random number generators (TRNGs) are not available.
Innovation Solution
Implementing an entropy service that provides a cryptographically strong random number seed to virtual machines, using a tiered cryptographic operation that combines TRNGs and PRNGs, and includes a hardware-based random number generator or a hardware security module to generate and distribute strong random number seeds, ensuring high entropy and security even in environments lacking TRNGs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If pseudorandom number generators (PRNGs) are used to generate random seeds, then the system can operate without hardware-based random number generators, but the security is weakened because PRNGs are predictable and susceptible to attacks
Solution Approach 1:
The patent introduces an entropy service as an intermediary component that bridges the gap between PRNGs and TRNGs. The entropy service collects entropy from various sources including TRNG when available, PRNG when TRNG is unavailable, and other entropy sources. This mediator allows the system to maintain cryptographic security by providing high-quality entropy to seed the PRNG, while still enabling operation in environments without hardware-based TRNGs.
Solution Approach 2:
The patent creates a composite entropy generation system that combines multiple entropy sources (TRNG, PRNG, and other entropy sources) into a unified entropy service. This composite approach allows the system to leverage the strengths of each source: TRNG provides high-quality random entropy when available, PRNG provides operational continuity when TRNG is unavailable, and additional entropy sources supplement the overall entropy pool. The combined system maintains cryptographic security while ensuring operational versatility.
2Reliability
If hardware-based random number generators (TRNGs) are used, then cryptographic security is enhanced with true randomness, but the system becomes more complex and less adaptable to environments without TRNG hardware
Solution Approach 1:
The entropy service is designed as a universal component that can operate in multiple environments with different hardware capabilities. It implements a tiered architecture that automatically adapts to the available resources: when TRNG is available, it collects entropy from TRNG; when TRNG is unavailable, it switches to PRNG and other software-based entropy sources. This multi-functionality allows the same system to maintain cryptographic security across diverse deployment scenarios without requiring TRNG hardware in every environment.
Solution Approach 2:
The system dynamically changes its entropy generation parameters based on the available hardware resources. The entropy service monitors the presence and functionality of TRNG, PRNG, and other entropy sources, adjusting its entropy collection strategy accordingly. This parameter adaptation allows the system to optimize cryptographic security when TRNG is available while maintaining operational capability when TRNG is absent, effectively managing hardware complexity through software-based parameter adjustment.
3Reliability
If constant maintenance and human interaction are required to monitor for attacks, then security can be maintained through careful monitoring, but the ease of operation is reduced and the system requires continuous human intervention
Solution Approach 1:
The entropy service implements self-service mechanisms that automatically monitor and respond to security conditions without requiring constant human intervention. The service continuously assesses the quality of entropy from various sources, automatically detects potential security issues such as entropy depletion or compromised sources, and adjusts its entropy collection strategy in real-time. This automated self-monitoring and self-adjustment capability maintains cryptographic security while significantly reducing the need for manual security monitoring and human intervention.
Data Source
AI summary
Servers in datacenters, mobile devices and virtualized servers without human interaction may experience difficulties in establishing entropy in a virtualized computing environment. Entropy is an important foundation for cryptography and a lack of entropy has led to weaknesses that can be used to break cryptographic systems in the past.