ENTROPY SHARING IN A LARGE DISTRIBUTED SYSTEM

• US 20170085654A1
• Filed: 09/17/2015
• Published: 03/23/2017
• Est. Priority Date: 09/17/2015
• Status: Active Grant

• Current Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Inventors: Mikhailov, Mikhail, Nair, Raj
• Granted Patent: US 9,979,794 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 7/58 Random or pseudo-random number generators
• CPC Class Codes: G06F 7/76 Arrangements for rearranging, permuting or selecting data according to predetermined rules, independently of the content of the data
• CPC Class Codes: H04L 2209/26 Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Methods and apparatus for sharing entropy between an entropy broker and various devices are shown. The entropy broker receives a communication from a client. Responsive to determining that the client provided entropy, the entropy broker processes the provided entropy and responsive to determining that the client requested entropy, the entropy broker adds the client to an entropy queue.

Claims

1. A method for sharing entropy, the method being operable at an entropy broker and comprising:

receiving a communication from a client;

responsive to determining that the client provided entropy, processing the provided entropy; and

responsive to determining that the client requested entropy, adding the client to an entropy queue.

2. The method as recited in claim 1 wherein processing the provided entropy comprises:

determining whether the provided entropy passed verification, the determining comprising testing the provided entropy for randomness; and

if the entropy passed verification, adding the provided entropy to an entropy pool.

3. The method as recited in claim 2 wherein testing the provided entropy for randomness comprises performing one of a chi-square test, a Kolmogorov-Smirnov test and a serial correlation test.

4. The method as recited in claim 2 wherein determining whether the provided entropy passed verification further comprises testing the provided entropy for repetition of previously received entropy from the client.

5. The method as recited in claim 4 further comprising using a digital rights management system for securely transporting and storing the entropy.

6. The method as recited in claim 1 further comprising, for a client in the entropy queue:

determining whether the amount of entropy available at the entropy broker is greater than a first threshold; and

if an amount of entropy available at the entropy broker is greater than a first threshold, allocating a first amount of unique entropy to the client.

7. The method as recited in claim 6 further comprising, for a client in the entropy queue:

if the amount of entropy available at the entropy broker is less than or equal to the first threshold, determining whether the amount of entropy available is greater than a second threshold and responsive to determining that the amount of entropy is greater than a second threshold and that the client is in a position in the queue that is below a queue threshold, allocating a second amount of duplicate entropy to the client; and

responsive to determining that the amount of entropy is less than the second threshold, denying the request for entropy.

8. The method as recited in claim 7 further comprising:

responsive to determining that the communication requested other functionality, processing a part of the communication not related to entropy; and

sending a response to the client.

9. The method as recited in claim 7 further comprising:

determining whether a demand for entropy is high; and

responsive to determining that the demand is high, recycling previously used entropy by combining one or more elements of a recycle pool of entropy via a mathematical operation.

10. The method as recited in claim 8 further comprising prioritizing recipients'"'"' requests based on at least one of a group comprising a client type, client capabilities, and protection available on the client.

11. The method as recited in claim 8 wherein the entropy broker is aware of the quality of entropy available on a client and provides information to a server regarding data to be delivered to the client.

12. The method as recited in claim 8 further comprising limiting an amount of entropy that a given client can receive in a given time period.

13. A method for sharing entropy, the method being operable at a device and comprising:

securely collecting entropy at the device;

determining whether the device has collected enough entropy for the device'"'"'s own use; and

responsive to determining that the device has not collected enough entropy for the device'"'"'s own use, requesting entropy from an entropy broker.

14. The method as recited in claim 13 wherein a request for entropy includes a make, model, operating system (OS) and OS version of the device.

15. The method as recited in claim 13 further comprising:

determining whether the requested entropy has been received; and

responsive to determining that the requested entropy has been received, securely storing excess entropy on the device.

16. The method as recited in claim 15 further comprising:

responsive to determining that the requested entropy has not been received, determining whether the available entropy is greater than a threshold; and

if the available entropy is not greater than the threshold, performing one of a group of actions comprising aborting a process that requires the entropy and proceeding with a weaker entropy, the performing being based on a current configuration of the device.

17. The method as recited in claim 13 further comprising:

determining whether the device has excess entropy;

responsive to determining that the device has excess entropy, securely storing the excess entropy on the device; and

securely sending the excess entropy to an entropy broker.

18. The method as recited in claim 13 wherein one of excess entropy and a request for entropy is sent as part of a request for other services.

19. An entropy broker, comprising:

a processor operably coupled to a memory;

an entropy receiving module that receives entropy from a first client; and

an entropy request fulfillment module that receives a request for entropy from a second client that is different from the first client and provides a given amount of received entropy to the second client.

20. A device comprising:

a processor operably coupled to a memory;

a communications system operably coupled to the processor; and

an entropy manager that provides entropy to applications operating on the device, the entropy manager further performing at least one of a group of actions comprising sending excess entropy to an entropy broker and requesting entropy from the entropy broker.