ACSE / PME / ASMP·1.0 — Technical Whitepaper

Abstract

Adaptive Cryptographic Surface Engineering (ACSE) is a new architectural layer that continuously mutates the observable cryptographic identity of protected systems — API endpoints, session tokens, network fingerprints, database connection identifiers, and TLS certificates — on every access event. The surface an attacker maps at time t is cryptographically independent of the surface that exists at time t+1.

This paper presents the complete ACSE stack: the Polymorphic Mutation Engine (PME) reference implementation, the Adaptive Surface Mutation Protocol (ASMP/1.0) for estate-wide coordination, 11 domain-specific mutation profiles, red-team evaluation results, and performance benchmarks across all profiles.

1. Introduction

1.1 The Static Surface Problem

Modern cyberattacks succeed not because encryption or firewalls fail, but because the observable surface of the target system — its fingerprints, identifiers, session tokens — remains static and predictable long enough for the attacker to build a usable model and act on it.

The result is visible in every major breach of the past decade: long dwell times measured in days and months, credential harvesting that pays off because credentials remain valid indefinitely, lateral movement across network topologies that stay mapped because the topology does not change.

1.2 The Core Insight

ACSE enforces one formal property — the Kali Invariant: for every protected surface S and every access event at time t, the observable fingerprint F(S, t+1) is cryptographically independent of F(S, t). The Hamming distance between successive fingerprints averages 128 bits — the expectation for two independently sampled SHA3-256 outputs.

An attacker who observes F(S, t) gains zero information about F(S, t+1). The reconnaissance model built over any number of cycles has no predictive power over the next cycle. The attacker's map expires before it can be acted on.

1.3 The KaliCore Philosophy

The PME engine is governed by KaliCore — the insight that continuous, autonomous surface mutation is not just a security feature but an operating principle. The name reflects the development lineage: built on Kali Linux, guided by the principle that Ma Kali — the goddess of time, transformation, and destruction of what is obsolete — best represents the engine's governing intelligence.

2. Background — What Existing Defences Miss

3. Architecture

3.1 Three-Layer Model

ACSE is structured as three co-operating layers. Each can be independently verified and independently deployed.

3.2 KaliCore — Governing Intelligence

KaliCore is the governing intelligence of the mutation engine — a three-subsystem triad that drives autonomous state transitions, manages entropy, and orchestrates the complete mutation lifecycle.

KaliCore transitions autonomously between three organ states based on the EWMA anomaly score: Sachs (steady-state), Hunter (elevated, score ≥ 0.35), and Main Organ (full response, score ≥ 0.70). Transitions are driven by authenticated anomaly signals from any source — network sensors, SIEM integrations, ASMP peer nodes.

3.3 PME Five Subsystems

The Polymorphic Mutation Engine comprises five co-operating subsystems, all orchestrated by MutationEngineCore:

• EntropyManager: ChaCha20-DRBG pool, health-gated, per-target SHA3-256 slicing — statistical independence across all registered targets
• CryptoAuditLogger: SHA3-256-chained append-only log — tamper-evident mutation history, hardware-attestation-bound in production
• StateTracker: Cryptographic checkpointing and atomic rollback — partial mutations structurally impossible
• Scheduler: Priority queue with burst coalescing — Kali Invariant cannot be starved or bypassed
• MutationTarget Registry: Plugin interface for all 11 profiles — swap by changing one registration call

3.4 The 4-Phase Atomic Mutation Cycle

Every mutation follows four phases regardless of profile. This guarantees the Kali Invariant cannot be violated by partial execution or system interruption.

3.5 3-Line Integration API

let mut engine = MutationEngineCore::new(tee_adapter);                     // Line 1
engine.register(Box::new(SquidShieldTarget::new("payments")), "fin");   // Line 2
engine.trigger_mutation(TriggerReason::PerInvocation, None);            // Line 3

4. The Dasa Mahavidya Profiles — 11 Domain-Specific Implementations

The 11 mutation profiles are not independent engines — they are 11 expressions of a single MutationEngineCore, each tuned to its domain's threat model and compliance requirements. All enforce the Kali Invariant identically.

* GlassFrog: low throughput by design — each cycle appends a HIPAA/GDPR cryptographic compliance proof. † ElectricEelGrid: Sachs steady-state mode shown. The only available product defending the power side-channel in COLO environments. All profiles sub-millisecond.

See WP-04: The Dasa Mahavidya Profiles for individual profile deep-dives, integration patterns, and performance analysis.

5. ASMP/1.0 — Adaptive Surface Mutation Protocol

ASMP/1.0 transforms PME from a node-level library into an estate-wide coordinated defence. Five authenticated message types carry the Kali Invariant across the network.

6. Implementation & Test Results

6.1 Technology Stack

• Language: Rust — zero
• unsafe
• blocks in the engine core; memory safety by construction
• Cryptography: SHA3-256 (Keccak) for all token derivation, fingerprinting, and audit chain linking. ChaCha20-DRBG for entropy.
• Benchmarking: Criterion — 100 samples per measurement, 3-second warmup,
• --release
• build. All numbers p50 medians on commodity x86_64.
• Testing: 683 unit tests · 0 failures · 0 warnings · 0 clippy errors
• Management: pme-console — Actix-Web dashboard (port 8888) with 6 tabs including Demo Harness for CERT-In evaluation

6.2 TEE Adapter Stack — All Five Production-Ready

Switching TEE adapters requires changing one constructor parameter. All profiles and all engine logic are adapter-agnostic.

7. Red Team Evaluation

The red team assumed a white-box adversary with full architectural knowledge, optimal algorithms, and an unconstrained tool set (Metasploit, Nmap, Wireshark, Burp Suite, custom Python). Attack duration was unbounded.

8. Performance Benchmarks

All benchmarks are Criterion p50 medians on commodity x86_64, --release build, 100 samples per measurement.

* GlassFrog low throughput by design (HIPAA proof per cycle). † Sachs mode; Hunter and Main Organ increase rate at lower throughput.

9. Case Studies

Three high-impact breaches illustrate exactly where and how PME would have intervened. In every case, the attack depended on a surface that remained static long enough to exploit.

9.1 Change Healthcare (February 2024)

Impact: $2.457B total cost · 192.7M patient records · $22M Bitcoin ransom · 9-day dwell

9.2 SolarWinds Orion (Detected December 2020)

Impact: 18,000+ organisations · 14+ months dwell · US federal agencies compromised

9.3 Stryker-Handala Wiper Attack (March 2026)

Impact: 50TB exfiltrated · 200,000+ devices wiped · 79 countries · ~6 months dwell

10. Conclusion

Adaptive Cryptographic Surface Engineering represents a fundamental shift from static defence to continuous cryptographic motion. The Kali Invariant is a structural property, not a policy assertion — enforced at every access event without exception by the mathematics of SHA3-256.

The complete stack — PME, ASMP/1.0, and 11 domain-specific profiles — is production-ready, with hardware-rooted attestation across five TEE environments and a 683-test suite with zero failures.