Lawful Interception Entropy Verification in Virtualized Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized network functions, the lack of control over entropy sources in cloud infrastructure poses a significant risk to the security of lawful interception functions, leading to potential decryption of sensitive data and eavesdropping due to weak encryption key generation.
Innovation Solution
A method where a first lawful interception function transmits a request for random number generator data to a second function within a virtualized network function, tests the randomness, and if below a threshold, sends an alarm signal to mitigate the issue by potentially stopping or reconfiguring the LI function to ensure adequate entropy for cryptographic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualized network functions are deployed in cloud infrastructure, then flexibility and adaptability of the system are improved, but control over entropy sources is lost leading to security risks
Solution Approach 1:
The patent introduces an intermediary component (entropy source management module) that mediates between the virtualized network function and the underlying cloud infrastructure entropy sources. This intermediary ensures controlled access to entropy sources, maintaining security while allowing virtualization flexibility. The module validates and manages entropy source selection without requiring direct control over the entire cloud stack.
Solution Approach 2:
The system is segmented into distinct functional modules: the virtualized network function, the entropy source management module, and the underlying cloud infrastructure. This segmentation allows each component to operate independently with defined interfaces, maintaining security boundaries while enabling flexibility in deployment. The entropy management module specifically handles randomness generation separately from the main VNF logic.
2Reliability
If blocking random generators are used to ensure high entropy, then cryptography security is improved, but real-time performance deteriorates due to generation delays
Solution Approach 1:
The system performs preliminary actions by pre-collecting and validating entropy sources before cryptographic operations are needed. The entropy source management module proactively monitors and accumulates sufficient entropy in advance, ensuring that when cryptographic key generation is required, high-entropy random numbers are already available without causing real-time delays.
Solution Approach 2:
The system dynamically adjusts entropy collection and validation based on operational needs. The entropy source management module continuously monitors entropy availability and adapts its collection rate, switching between blocking and non-blocking modes as appropriate. This dynamic approach ensures high security when entropy is available while maintaining real-time performance when operations are urgent.
Data Source
Figure 1a~1b
Figure 2a~2b
Figure 2c
AI summary
A first lawful interception (LI) function (110) transmits, to a second LI function (101) in a virtualized network function, VNF (103), a request for random number generator, RNG, data, characterizing a random number generator (105) in the second LI function (101). The RNG data is tested, resulting in a randomness test result that is indicative of randomness of numbers generated by the RNG (105) in the second LI function (101). If the randomness is below a first threshold, mitigation takes place of any undesired effect associated with the randomness being less than the threshold value. A corresponding method is performed by the second LI function (101), receiving the request for RNG data, obtaining and transmitting the RNG data to the first LI function (110). Verification can thereby be made whether a LI function in a VNF has a proper level of entropy source for use by its cryptographic operations and, if not, perform mitigation.