# US 2008/0189356 A1 · Stealth entropy collection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0189356 A1 - Document ID: US20080189356A1 - Status: Published application - Kind: A1 - Application number: 11/702,453 - Filed: 2007-02-05 - Published: 2008-08-07 - Earliest claimed: 2007-02-05 - Assignees: Novell, Inc. - Inventors: Kasman E. Thomas; Stephen R. Carter - Web page: https://patentgrep.com/patent/US20080189356A1 ## CPC - H04L 63/1458: {Denial of Service} - G06F 7/58: Random or pseudo-random number generators - G06F 7/588: {Random number generators, i.e. based on natural stochastic processes} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0872: {using geo-location information, e.g. location data, time, relative position or proximity to other entities} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In a computing system environment, methods and apparatus include tapping a plurality of connected computing devices and distilling small amounts of entropy from each, concentrating the entropy so collected, and performing all in a stealth or surreptitious fashion relative to the providers of the entropy. In this manner: the potential supply of entropy on a networked computing device is greatly expanded; the potential for entropy-related denial-of-service attacks in Linux systems is reduced; no significant extra processing burden on participating computing devices is required; and enlisting entropy-providing computing devices (including or not naive applications) in entropy exchanges occurs unobtrusively. Representative particular environments include web servers, including servlet filters, and clients engaged in http sessions; Java virtual machines; network interface cards in promiscuous mode analyzing packets; and other. Computer program products for devices to realize the foregoing are also intended. ## Claims ### Claim 1 In a computing system environment having more than one computing device arranged together, a method of surreptitiously gathering entropy data, comprising: exchanging requests and responses between the more than one computing devices; and by one of the more than one computing devices, collecting entropy data unbeknownst to another of the more than one computing devices, wherein the collecting includes examining the requests of the another of the more than one computing devices for the responses that would yield a particular response having unpredictability. ### Claim 2 (depends on 1) The method of claim 1, wherein the collecting entropy data further includes examining the requests of the another of the more than one computing devices for one of mouse-event data, inter-keystroke timing data, inter-interrupting timing values and event timestamp data. ### Claim 3 (depends on 1) The method of claim 1, wherein the exchanging requests and responses includes engaging a http session between a web server and a web client. ### Claim 4 (depends on 1) The method of claim 1, wherein the exchanging requests and responses includes placing a network interface card in a promiscuous mode. ### Claim 5 (depends on 1) The method of claim 1, further including using the collected entropy data as a seed value for a pseudo random number generator. ### Claim 6 (depends on 1) The method of claim 1, further including outsourcing the collected entropy data to a data recipient. ### Claim 7 In a computing system environment having more than one computing device actively arranged together for other than collection of entropy data, a method of surreptitiously gathering entropy data, comprising: exchanging requests and responses between a web server and a web client, the web server including a servlet filter for analyzing the requests from the web client; and by the web server, collecting entropy bits from the analyzed requests, the collecting occurring unbeknownst to the web client. ### Claim 8 (depends on 7) The method of claim 7, wherein the exchanging requests and responses includes exchanging http requests and responses. ### Claim 9 (depends on 7) The method of claim 7, further including buffering the entropy bits for immediate or later use or outsourcing by the web server. ### Claim 10 (depends on 7) The method of claim 7, wherein the collecting entropy bits further includes examining the requests of the web client for one of mouse-event data, inter-keystroke timing data, inter-interrupting timing values and event timestamp data. ### Claim 11 (depends on 7) The method of claim 7, further including calling an entropy-based function on the web client for returning to the web server. ### Claim 12 In a Java virtual machine having integral services and at least one application, a method of surreptitiously gathering entropy data, comprising: by the at least one application, requesting a response from the integral services; and collecting entropy bits from the response, the collecting occurring unbeknownst to the at least one application. ### Claim 13 (depends on 12) The method of claim 12, further including buffering the entropy bits for immediate or later use or outsourcing by the Java virtual machine. ### Claim 14 In a computing system environment having more than one computing device arranged together for other than collection of entropy data, a method of surreptitiously gathering entropy data, comprising: placing a network interface card (NIC) in a promiscuous mode; by the NIC, receiving any packet coming to the NIC; and unbeknownst to the packet or a sender of the packet, analyzing one or more of the any packets for entropy data. ### Claim 15 (depends on 14) The method of claim 14, wherein the analyzing includes one of determining a length of the one or more of the any packets, determining a time between the one or more of the any packets, and determining a rate of collisions between the one or more of the any packets. ### Claim 16 A computing system for surreptitiously gathering entropy data, comprising: a web server having a servlet filter; a web client connected to the web server for sending requests to and receiving responses from the web server by way of the servlet filter; and an entropy bit buffer for use or outsourcing of entropy bits by the web server as a seed value, the servlet filter having logic able to 1) examine the requests of the web client for response data having unpredictability and 2) siphon the response data as entropy bits to the entropy bit buffer unbeknownst to the web client. ### Claim 17 (depends on 16) The computing system of claim 16, further including one or more entropy-based functions on the web client callable by an application of the web client for values returnable to the web server. ### Claim 18 A Java virtual machine for surreptitiously gathering entropy data, comprising: an integral services component; one or more applications able to call on the integral services component; and an entropy bit buffer for use or outsourcing of entropy bits by the Java virtual machine as a seed value, the integral services component having logic able to 1) examine the calls of the one or more applications for response data having unpredictability and 2) siphon the response data as entropy bits to the entropy bit buffer unbeknownst to the one or more applications. ### Claim 19 A network interface card (NIC) for surreptitiously gathering entropy data, comprising: one or more modes including a promiscuous mode to enable receipt of any packet that comes to the NIC; a logic component to analyze the any packets; and an entropy bit buffer for use or outsourcing of entropy bits by the NIC as a seed value, the logic component to 1) examine the any packets and 2) siphon unpredictable characteristics of the any packets as entropy bits to the entropy bit buffer unbeknownst to the any packets or a sender of the any packets. ### Claim 20 A computer program product having executable instructions available as a download or on a computer-readable medium for use in a computing system environment for surreptitiously gathering entropy data, comprising: a first component to analyze requests from a computing device or application of the computing device for responses to the requests that would yield unpredictability; and a second component to collect data bits from the responses that would yield unpredictability, the second component being able to collect the data bits unbeknownst to the computing device or application making the request.