Systems and methods for estimating a crypto-agility score of a network of computing assets

An apparatus for determining an optimized crypto-agile network configuration, the apparatus comprising:

• communications hardware configured to:
• receive a network graph comprising nodes representing computing assets and edges representing relationships between the nodes;
• and
• receive importance weights corresponding to at least a subset of the nodes;
• upgrade analysis circuitry configured to:
• compute, for a first network configuration represented by the network graph, a first crypto-agility score based on upgrade costs associated with the nodes and the importance weights;
• cause a plurality of perturbations of the network graph to generate a plurality of perturbed network graphs, each perturbation of the plurality of perturbations comprising at least one of:
• adding a node, removing a node, adding an edge, removing an edge, changing a property of a node, or changing a property of an edge;
• for each perturbed network graph, compute a corresponding perturbed crypto-agility score based on perturbed weighted upgrade costs determined from dependencies among the nodes of the respective perturbed network graph;
• determine, using the perturbed crypto-agility scores, a locally optimal network configuration;
• and
• wherein the communications hardware is further configured to:
• send, to a computing device, data indicating the locally optimal network configuration and the perturbation that generated the locally optimal network configuration.

A computer program product for determining an optimized crypto-agile network configuration, the computer program product comprising at least one non-transitory computer-readable storage medium storing software instructions that, when executed, cause an apparatus to:

• receive a network graph comprising nodes representing computing assets and edges representing relationships between the nodes;
• receive importance weights corresponding to at least a subset of the nodes;
• compute, for a first network configuration represented by the network graph, a first crypto-agility score based on upgrade costs associated with the nodes and the importance weights;
• cause a plurality of perturbations of the network graph to generate a plurality of perturbed network graphs, each perturbation of the plurality of perturbations comprising at least one of:
• adding a node, removing a node, adding an edge, removing an edge, changing a property of a node, or changing a property of an edge;
• for each perturbed network graph, compute a corresponding perturbed crypto-agility score based on perturbed weighted upgrade costs determined from dependencies among the nodes of the respective perturbed network graph;
• determine, using the perturbed crypto-agility scores, a locally optimal network configuration;
• and
• send, to a computing device, data indicating the locally optimal network configuration and the perturbation that generated the locally optimal network configuration.