Stealth entropy collection
In a computing system environment, methods and apparatus include tapping a plurality of connected computing devices and distilling small amounts of entropy from each, concentrating the entropy so collected, and performing all in a stealth or surreptitious fashion relative to the providers of the entropy. In this manner: the potential supply of entropy on a networked computing device is greatly expanded; the potential for entropy-related denial-of-service attacks in Linux systems is reduced; no significant extra processing burden on participating computing devices is required; and enlisting entropy-providing computing devices (including or not naïve applications) in entropy exchanges occurs unobtrusively. Representative particular environments include web servers, including servlet filters, and clients engaged in http sessions; Java virtual machines; network interface cards in promiscuous mode analyzing packets; and other. Computer program products for devices to realize the foregoing are also intended.
1. In a computing system environment having more than one computing device arranged together for other than collection of entropy data, a method of surreptitiously gathering entropy data, comprising:
placing a network interface card (NIC) of one computing device of the more than one computing devices in a promiscuous mode;
by the NIC, receiving any current packet coming to the NIC from another computing device of the more than one computing devices;
by a logic component in the NIC, unbeknownst to the packet or a sender of the packet analyzing the current packets for entropy data regardless of whether the one or another computing devices ever earlier communicated while the one computing device provides an expected response to the another computing device of the more than one computing devices; and
extracting and buffering said entropy data for entropy data use.
2. The method of claim 1 , wherein the analyzing includes one of determining a length of the one or more of the any current packets, determining a time between the one or more of the any packets, and determining a rate of collisions between the one or more of the any packets.
3. The method of claim 1 , further including using the extracted entropy data as a seed value for a pseudo random number generator.
4. The method of claim 1 , further including outsourcing the extracted entropy data to a data recipient.
5. The method of claim 1 , further including buffering the entropy bits for immediate or later use or outsourcing by the one computing device.
6. A common computing device for surreptitiously gathering entropy data, comprising:
a network interface card (NIC) having one or more modes including a promiscuous mode to enable receipt of any packet that comes to the NIC from a second computing device external to the common computing device;
a logic component in the NIC to analyze the any packets; and
an entropy bit buffer connected to the NIC within the common computing device for use within the common computing device or outsourcing to another computing device of entropy bits by the NIC as a seed value, the logic component to 1) examine the any packets and 2) siphon unpredictable characteristics of the any packets as entropy bits to the entropy bit buffer unbeknownst to the any packets or the second computing device, regardless of whether the common computing device or the second computing device have ever earlier communicated with one another, the unpredictable characteristics of the any packets being siphoned as entropy bits to the entropy bit buffer for entropy data use.
7. The common computing device of claim 6 , wherein the entropy bit buffer outsources the entropy bits to the another computing device as a seed value for a pseudo random number generator.
8. The common computing device of claim 6 , wherein the entropy bit buffer outsources the entropy bits to a data recipient.