TorpedoRay — Transport Channel Surface Mutation and the Data-in-Transit Gap

Abstract

The ten Dasa Mahavidya profiles of the Adaptive Cryptographic Surface Engineering (ACSE) framework protect every major attack surface: API endpoints, credential surfaces, database layers, network topology, management planes, and data-centre power channels. One surface was not covered: the transport channel itself — the observable fingerprint of the connection that carries all other traffic.

TorpedoRay (Profile 0x0B) closes this gap. On every mutation cycle, TorpedoRay rotates the cipher suite pattern, extension ordering, handshake timing, packet size distribution seed, timing jitter seed, and in-transit session token. The combined channel fingerprint — SHA3-256 of all observable properties — is cryptographically independent of the previous cycle's fingerprint. An observer watching the channel cannot correlate packet N with packet N+1 as belonging to the same session.

This paper documents the threat model TorpedoRay addresses, the architecture, the four patent claims, the Torpedo mechanism, and the implementation evidence. 360 tests pass. 0 failures. The profile is committed to the patent-evidence repository at commit 98acde6.

1. The Data-in-Transit Gap

1.1 What the first ten profiles protect

The ten Mahavidya profiles each protect a different kind of surface:

None of these profiles address what the channel connecting them looks like to an external observer. The cipher suite negotiation, the extension ordering, the handshake timing pattern, the packet size distribution — these are all static per TLS implementation. They identify the software stack in use. An observer watching the traffic knows what they are dealing with before they have broken anything.

1.2 The question that came from multiple reviewers

The recurring question during review: "What is the protection for data in transit?"

TLS protects the content. The content is encrypted. But TLS does not protect the observable fingerprint of the connection itself. The cipher suite list in a TLS ClientHello is static per TLS library. JA3 fingerprinting tools identify TLS implementations with very high accuracy — in effect, they identify the software version of the client or server. An attacker with passive network access does not need to decrypt anything to know what is running.

TorpedoRay makes the channel fingerprint as dynamic as the surfaces it connects. The observer cannot tell what is running. The observer cannot tell whether packet N and packet N+1 belong to the same session. The observer's model of the channel is invalidated on every mutation cycle.

2. Threat Model

TorpedoRay addresses five distinct threats at the transport layer. None of these are addressed by the existing ten profiles or by TLS 1.3.

3. TorpedoRay Architecture

3.1 Position in the PME stack

TorpedoRay is registered as a standard MutationTarget in the PME engine — profile ID 0x0B. It implements the same interface as all other profiles. The engine calls mutate(entropy) on each cycle; TorpedoRay applies its transport-layer mutations and recomputes the combined channel fingerprint.

3.2 What mutates per cycle

Six properties are mutated on every call to mutate(entropy). All six contribute to the combined channel fingerprint. The fingerprint is SHA3-256 of all six concatenated.

4. The Kali Invariant for Transport

The Kali Invariant for the ten surface profiles states: for every surface S and every access event at time t, the observable fingerprint F(S, t+1) is cryptographically independent of F(S, t).

TorpedoRay applies the same invariant to the transport channel:

This is enforced in the implementation by the recompute_fingerprint() function, which recomputes the SHA3-256 hash of all six observable properties after every mutation cycle. The test one_hundred_cycles_all_unique_fingerprints verifies that 101 consecutive fingerprints (initial + 100 cycles) are all distinct — 100% uniqueness, zero collisions.

/// Kali Invariant check in mutate():
if before_fp == after_fp {
    return MutationResult::failure(
        self.id.clone(),
        "TorpedoRay: Kali Invariant violation — channel fingerprint unchanged",
    );
}

The invariant violation check is not optional. Every mutation that fails to change the channel fingerprint returns a failure result — which the engine core treats as a rollback trigger. The invariant is enforced at the protocol layer, not at the application layer.

5. What TLS Does Not Do

The question is asked frequently: if TLS 1.3 already encrypts the channel, what does TorpedoRay add? The answer is precise and important for the patent claims.

6. Patent Claims A–D

TorpedoRay's four patent claims are derived from the threat model and the implementation. Each is independently defensible and maps to a distinct technical mechanism.

7. The Torpedo Mechanism

7.1 What it is

The Torpedo is not a separate system. It is a mode of the TorpedoRay mutation cycle that activates when the EWMA anomaly scorer crosses the TORPEDO_THRESHOLD of 0.70. In normal operation (Sachs and Hunter states), mutations rotate the six channel properties at the standard rate. In MainOrgan state, the Torpedo fires: an immediate, simultaneous rotation of all six properties in a single cycle.

The key property is that the Torpedo fires without terminating the session. The legitimate session continues. The observer's model of the channel — built from packets 1 through N — is invalidated. They are watching a different channel from packet N+1 onwards, even though the same legitimate connection is carrying data.

7.2 Cryptographic proof of firing

Every Torpedo event produces a TorpedoFireRecord appended to the target's torpedo log. The record contains: the sequence number, the trigger score, the channel fingerprint before the Torpedo, the channel fingerprint after, and a SHA3-256 torpedo_token derived from all of the above plus the entropy used. The token is non-repudiable — it proves the Torpedo fired, that the fingerprint changed, and which entropy drove the change. This record is suitable for use as audit evidence in CERT-In and regulatory reporting contexts.

pub struct TorpedoFireRecord {
    pub sequence:           u64,
    pub timestamp_ms:       u64,
    pub trigger_score:      f64,
    pub fingerprint_before: [u8; 32],
    pub fingerprint_after:  [u8; 32],  // must differ from before
    pub torpedo_token:      [u8; 32],  // SHA3-256 proof of event
}

8. Implementation Evidence

8.1 Test suite

TorpedoRay ships with 25 dedicated unit tests and two engine integration tests. All 360 workspace tests pass. 0 failures. 0 warnings. Committed at 98acde6.

8.2 Organ state thresholds

8.3 Cipher and extension pools

TorpedoRay uses real IANA cipher suite codes and TLS extension type values. The pools are not simulated — they are the actual values that appear in TLS ClientHello messages and that JA3 hashes. Cipher pool: 9 entries (TLS 1.3 suites + ECDHE suites with AES-GCM and ChaCha20). Extension pool: 15 entries (server_name through key_share and renegotiation_info). The Fisher-Yates-style permutation driven by entropy bytes produces a different ordering each cycle.

9. Phased Delivery

TorpedoRay is designed with protocol-agnostic adapters. The three transport modes are defined as an enum at the type level; Phase 1 is fully implemented. Phases 2 and 3 define the interface without implementing it — ensuring the design is settled before the implementation work begins.

The protocol-agnostic design is itself a patent-relevant architectural claim: the channel mutation principle is independent of the transport protocol. The same fingerprint independence property holds for ASMP, TLS, and TCP — only the adapter differs.

10. Conclusion

TorpedoRay closes the last major gap in the ACSE surface coverage. Every surface in a protected enterprise estate now has a corresponding mutation profile: API surfaces, credential surfaces, data surfaces, topology surfaces, management surfaces, power/thermal surfaces, and now transport channel surfaces.

The question that came from multiple reviewers — "what about data in transit?" — has a precise, patent-evidenced answer. TLS protects the content. TorpedoRay protects the channel fingerprint independently of TLS. An observer watching the network cannot fingerprint the implementation, cannot correlate sessions, cannot replay intercepted tokens, and cannot build a stable model of the channel before the Torpedo fires and resets it.

360 tests pass. The implementation is committed to the patent-evidence repository. The four claims — channel fingerprint independence, JA3/JA3S defeat, in-transit session token rotation, and the Torpedo mechanism — are each independently evidenced by the test suite.