Innovations | Chiensec

Future Innovations -- with Whitepapers

Neutralizing Vulnerabilities Through Execution Prevention:

The cybersecurity industry is locked in a perpetual arms race. Each year, tens of thousands of new software vulnerabilities are disclosed, and the pace is accelerating. In the first half of 2025 alone, over 21,500 Common Vulnerabilities and Exposures (CVEs) were cataloged — an 18% increase over the same period the prior year — with approximately 38% rated High or Critical in severity. Attackers now routinely weaponize newly disclosed CVEs within hours of publication, far outpacing the ability of most organizations to test and deploy patches. The traditional model of reactive security — discover, patch, monitor, respond — is failing under the sheer volume and velocity of modern threats.

This whitepaper presents a fundamentally different approach. It argues that the vast majority of cybersecurity vulnerabilities — including remote code execution (RCE), privilege escalation, buffer overflows, injection attacks, and malware delivery — share a common prerequisite: they require the execution of unauthorized code on the target system. Whether an attacker injects shellcode through a buffer overflow, delivers a ransomware binary via phishing, or exploits a deserialization flaw to instantiate a malicious object, the attack succeeds only when unauthorized executable code runs on the victim machine.

The architectural security model described herein, developed and patented by Daniel Chien across 16 U.S. patents, eliminates the conditions under which unauthorized code can execute. By combining three reinforcing architectural principles — the elimination of listening network ports, the prevention of unauthorized program execution, and strict outbound connection whitelisting — this model neutralizes entire classes of vulnerabilities at the architectural level rather than chasing individual exploits one by one.

This approach represents a paradigm shift from reactive patching to proactive architectural immunity. It does not depend on signature databases, heuristic detection, or the speed of patch deployment. Instead, it removes the foundational prerequisites that attackers depend upon to convert a software flaw into a successful compromise. In a landscape where AI is accelerating vulnerability discovery and exploit development, and where the volume of CVEs has long exceeded human capacity to remediate, architectural solutions that structurally eliminate attack surfaces are no longer optional — they are essential.

The Unhackable Endpoint:

This whitepaper presents a rigorous technical analysis of Zero Attack Surface Architecture (ZASA) — a security model for internet-connected endpoint devices that achieves near-theoretical immunity to all known categories of remote attack by eliminating the structural preconditions on which those attacks depend, rather than attempting to detect or mitigate them after they are initiated. The central argument is as follows: every known class of remote cyberattack against an endpoint requires at least one of four preconditions to be satisfied — (1) an inbound listening port or service reachable from the network, (2) a remote access interface (SSH, RDP, or VNC) that accepts inbound connections, (3) the ability of code to communicate outbound to attacker-controlled infrastructure, or (4) the ability to execute an attacker-supplied binary. A device from which all four preconditions have been systematically eliminated cannot be remotely compromised by any attack technique presently documented in the MITRE ATT&CK framework or the NIST National Vulnerability Database.

Immutable Execution Environment: A Minimal OS Modification to Permanently Stop Ransomware and Malware:

Global ransomware damages reached $57 billion in 2025 and are projected to exceed $275 billion annually by 2031. Despite decades of investment in antivirus, endpoint detection and response (EDR), and signature-based defenses, ransomware and malware continue to proliferate because these defenses operate reactively—attempting to identify malicious behavior after execution has begun. This paper presents the Immutable Execution Environment (IEE), a kernel-level architecture that eliminates malware execution by enforcing a strict whitelist of directories from which code may execute. The IEE requires approximately 80 lines of new kernel code and a 15-to-25 entry directory whitelist. Three surgical kernel modifications prevent all non-whitelisted code execution, render whitelisted paths immutable and read-only, and make critical data unencryptable. The design eliminates the need for antivirus, EDR, and signature-based defenses entirely, providing a mathematically provable guarantee: code that cannot execute cannot cause damage. We analyze IEE’s threat model, performance characteristics, compatibility implications, and practical deployment considerations.

Private-Keyless, Passwordless, Time-Based Authentication: A Novel Protocol for Secrets-Free Identity Verification

Contemporary authentication systems rely on shared secrets — passwords stored on servers, private keys stored on clients, or pre-shared symmetric keys — all of which create single points of compromise. This paper presents a Private-Keyless, Passwordless, Time-Based Authentication protocol (PKPTA) that eliminates all persistent shared secrets from the authentication exchange while maintaining strong identity assurance. Identity verification is achieved through time-synchronized computation over a mutually known public context without transmitting or storing any secret material. The protocol derives authentication tokens from synchronized time state, public identity attributes, and a deterministic function known to both parties, producing tokens that are valid only within a bounded time window and cannot be replayed or pre-computed without access to the current time state. The design is especially relevant to resource-constrained environments and zero-trust architectures where credential storage represents a critical attack surface. Formal security properties are analyzed, a comparison with existing authentication paradigms is presented, and practical implementation guidance is provided.

Adaptive Multi-Layered DDoS Defense Architecture: A Dynamic, Intelligence Driven Approach to Distributed Denial of-Service Mitigation

This paper presents an Adaptive Multi-Layered DDoS Defense Architecture designed to mitigate volumetric, protocol-layer, and application-layer Distributed Denial-of-Service (DDoS) attacks in contemporary production environments. Industry telemetry from 2025 reports DDoS attack volume doubled to 47.1 million events, with peak observed attacks reaching 31.4 Tbps and application-layer malicious traffic surging 128% year-over-year. The proposed architecture integrates five complementary defensive mechanisms: dynamic Exponential Moving Average (EMA)-based threshold monitoring, an IP reputation scoring system (scored 0–100), SYN cookie authentication per RFC 4987, selective packet dropping via Random Early Detection (RED), geo-based traffic throttling using BGP-derived geolocation data, and a five-tier graceful degradation framework. Compound trigger logic across five real-time metrics enables detection of multi-vector campaigns that evade single-metric thresholds. A whitelist tier ensures continuity for CDN nodes, partner infrastructure, and internal assets. The system is engineered such that legitimate user impact remains below 2% during active mitigation, with challenge-page completion rates projected above 98% for authenticated browsers. Future extensions include machine learning-based anomaly detection and upstream BGP community integration for null-routing.

DC-TDCS: A Dual-Clock Time-Derived Cryptographic System for Forward-Secret, Stolen-Device-Resistant Session Key Derivation

We present DC-TDCS (Dual-Clock Time-Derived Cryptographic System), a novel authenticated encryption framework in which session key material is derived from a consensus value computed across two independent, heterogeneous time sources: a device-resident hardware real-time clock (Clock A) and a server-authoritative network timestamp (Clock B). Unlike TOTP/HOTP, which use time solely for authentication codes, DC-TDCS extends time-binding to the full cryptographic key schedule via HKDF (RFC 5869), delivering three headline properties: (1) forward secrecy through epoch-bounded key erasure, (2) stolen-device resistance via dual-source time consensus, and (3) clock-manipulation resistance requiring simultaneous control of both independent clock sources. The protocol employs only standardized primitives—X25519, AES-256-GCM, HKDF, and Argon2id—and is designed for integration with hardware security modules, TPM 2.0, and ARM TrustZone environments. Formal security arguments are provided under standard cryptographic assumptions.

Buffer Overflow Attacks: A Critical Technical Analysis of Mechanics, Limitations, and Modern Defenses

Buffer overflow attacks remain one of the most consequential vulnerability classes in software security, responsible for a significant share of exploitable CVEs across four decades of computing history. Despite extensive study, buffer overflows continue to appear in modern codebases due to the enduring use of memory-unsafe languages. This paper provides a rigorous technical analysis of buffer overflow mechanics, grounded in the x86/x64 call stack structure, virtual memory architecture, and the three fundamental address-resolution problems attackers must solve. We examine classic stack-based overflows, modern mitigations including Address Space Layout Randomization (ASLR), stack canaries, non-executable memory (NX/DEP), and Position-Independent Executables (PIE), and the evolution of exploitation techniques beyond classic overflow — including Return-Oriented Programming (ROP), heap exploitation, and use-after-free. The paper is oriented toward graduate-level computer science students and security practitioners who require a precise mental model of how these attacks operate, why mitigations are effective, and where residual risks remain.

The Bottom-Most Received Header: Deterministic Sender Verification via Unforgeable SMTP Network Metadata

Phishing and email spoofing attacks exploit fundamental weaknesses in the Simple Mail Transfer Protocol's trust model, with an estimated 3.4 to 4 billion phishing emails sent daily. Existing countermeasures — SPF, DKIM, and DMARC — provide partial protection but depend on voluntary domain owner adoption, suffer from complex alignment rules, and remain absent on the majority of domains. This paper presents a deterministic sender verification technique based on the bottom-most Received header, an SMTP metadata field inserted by the first receiving mail server that records the originating IP address from an operating-system-level TCP socket binding. Unlike the From header or domain-level authentication records, the bottom-most Received header cannot be forged by the sending party because it is written by the receiving server, not the sender. We analyze the cryptographic and network properties that make this field an unforgeable trust anchor, compare it to SPF, DKIM, and DMARC, present a verification framework leveraging this principle, and discuss deployment considerations including current adoption gaps.

Unmasking the Caller: Leveraging SIP Metadata, IP Analysis, and Network-Layer Verification to Combat VoIP Robocall Fraud:

VoIP robocall fraud represents a pervasive and escalating threat to telecommunications security, with Americans receiving an estimated 52.8 billion robocalls in 2024 alone—equivalent to approximately 1,627 calls per second. Fraudsters systematically exploit the SIP From header for caller ID spoofing; however, the originating IP address embedded in SIP Via and Contact headers per RFC 3261 cannot be concealed without control of Border Gateway Protocol (BGP) routing infrastructure. This paper presents a multi-layer IP attribution framework combining GeoIP geolocation, WHOIS/ASN ownership lookup, STIR/SHAKEN attestation analysis, and a composite behavioral risk scoring model to identify fraudulent VoIP callers with high confidence. Particular attention is directed toward the disproportionate targeting of Asian-American communities by organized robocall fraud operations, as documented in FBI Public Service Announcement I-111325-PSA (November 2025). The paper further proposes a smartphone caller display standard that surfaces IP-layer caller identity metadata in multiple languages, enabling informed call acceptance decisions by vulnerable populations. Results demonstrate that IP attribution correctly identifies call origin even when caller ID is spoofed, and that C-level STIR/SHAKEN attestation strongly correlates with fraudulent origination.

Find more about TCP/IP Facts:

ChienSEC