Skip to content

README.md

Latest commit

 

History

History
215 lines (168 loc) · 7.76 KB

README.md

File metadata and controls

215 lines (168 loc) · 7.76 KB

SAFE-M-30: Vector Store Integrity Verification

Overview

Mitigation ID: SAFE-M-30
Category: Cryptographic Control
Effectiveness: High
Implementation Complexity: Medium
First Published: 2025-09-13

Description

Vector Store Integrity Verification is a cryptographic control that ensures the authenticity and integrity of embeddings stored in vector databases used by MCP servers. This mitigation prevents attackers from inserting or modifying malicious embeddings by requiring cryptographic signatures for all vector store operations.

The control implements a chain of trust where each embedding is cryptographically signed before storage, and signatures are verified before retrieval. This prevents both direct manipulation of the vector store and supply chain attacks that attempt to distribute pre-poisoned embeddings.

Mitigates

Core Principles

1. Cryptographic Signing

  • All embeddings must be cryptographically signed before storage
  • Signatures use HMAC-SHA256 with a secret key
  • Signature includes embedding content, metadata, and timestamp

2. Chain of Trust

  • Each embedding carries a signature from a trusted authority
  • Signatures are verified before any retrieval or processing
  • Invalid signatures result in immediate rejection

3. Key Management

  • Secret keys are stored securely (HSM, key vault, or secure environment)
  • Key rotation policies are implemented
  • Different keys for different environments (dev, staging, prod)

Architecture

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   MCP Server    │    │  Vector Store    │    │  Key Management │
│                 │    │                  │    │                 │
│ ┌─────────────┐ │    │ ┌──────────────┐ │    │ ┌─────────────┐ │
│ │ Embedding   │ │───▶│ │ Signed       │ │    │ │ Secret Key  │ │
│ │ Generator   │ │    │ │ Embeddings   │ │    │ │ Storage     │ │
│ └─────────────┘ │    │ └──────────────┘ │    │ └─────────────┘ │
│                 │    │                  │    │                 │
│ ┌─────────────┐ │    │ ┌──────────────┐ │    │                 │
│ │ Signature   │ │◀───│ │ Verification │ │    │                 │
│ │ Verifier    │ │    │ │ Engine       │ │    │                 │
│ └─────────────┘ │    │ └──────────────┘ │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘

Implementation

1. Embedding Signing Service

import hmac
import hashlib
import json
from datetime import datetime
from typing import Dict, Any

class EmbeddingSigner:
    """Provides cryptographic signing for embeddings"""
    
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode()
    
    def sign_embedding(self, embedding_data: Dict[str, Any]) -> str:
        """Sign embedding data"""
        canonical_data = json.dumps(embedding_data, sort_keys=True, separators=(',', ':'))
        signature = hmac.new(
            self.secret_key,
            canonical_data.encode(),
            hashlib.sha256
        ).hexdigest()
        return signature
    
    def verify_signature(self, embedding_data: Dict[str, Any], signature: str) -> bool:
        """Verify embedding signature"""
        expected_signature = self.sign_embedding(embedding_data)
        return hmac.compare_digest(expected_signature, signature)

2. Secure Vector Store

class SecureVectorStore:
    """Vector store with integrity verification"""
    
    def __init__(self, signer: EmbeddingSigner):
        self.signer = signer
        self.embeddings = {}
    
    def store_embedding(self, id: str, embedding_data: Dict[str, Any]) -> bool:
        """Store embedding with signature"""
        try:
            signature = self.signer.sign_embedding(embedding_data)
            signed_data = {
                'data': embedding_data,
                'signature': signature,
                'timestamp': datetime.utcnow().isoformat()
            }
            self.embeddings[id] = signed_data
            return True
        except Exception as e:
            print(f"Failed to store embedding: {e}")
            return False
    
    def retrieve_embedding(self, id: str) -> Dict[str, Any]:
        """Retrieve and verify embedding"""
        if id not in self.embeddings:
            return None
        
        signed_data = self.embeddings[id]
        if not self.signer.verify_signature(signed_data['data'], signed_data['signature']):
            raise SecurityException("Invalid signature detected")
        
        return signed_data['data']

Benefits

1. Integrity Assurance

  • Prevents unauthorized modification of embeddings
  • Ensures data hasn't been tampered with
  • Maintains trust in vector store content

2. Attack Prevention

  • Blocks direct vector store manipulation
  • Prevents supply chain attacks
  • Stops embedding injection attacks

3. Audit Trail

  • All operations are cryptographically signed
  • Timestamps provide temporal integrity
  • Enables forensic analysis

Limitations

1. Performance Impact

  • Cryptographic operations add latency
  • Key management overhead
  • Signature verification on every retrieval

2. Key Management Complexity

  • Secure key storage required
  • Key rotation procedures needed
  • Backup and recovery planning

3. Implementation Requirements

  • Requires cryptographic libraries
  • Secure key management infrastructure
  • Updated vector store implementations

Testing

1. Unit Tests

  • Test signature generation and verification
  • Test invalid signature detection
  • Test key rotation scenarios

2. Integration Tests

  • Test with real vector store operations
  • Test performance under load
  • Test error handling

3. Security Tests

  • Test signature forgery attempts
  • Test key compromise scenarios
  • Test timing attacks

Monitoring

1. Signature Verification Failures

  • Monitor failed signature verifications
  • Alert on suspicious patterns
  • Track failure rates

2. Key Usage

  • Monitor key rotation events
  • Track signature generation rates
  • Alert on unusual patterns

3. Performance Metrics

  • Monitor signing/verification latency
  • Track throughput impact
  • Monitor resource usage

Compliance

1. Security Standards

  • Aligns with cryptographic best practices
  • Supports compliance requirements
  • Enables audit capabilities

2. Data Protection

  • Ensures data integrity
  • Supports data governance
  • Enables regulatory compliance

Related Mitigations

  • SAFE-M-31: Embedding Sanitization and Validation
  • SAFE-M-32: Vector Store Isolation and Containment
  • SAFE-M-33: Continuous Vector Store Monitoring

Version History

Version Date Changes Author
1.0 2025-09-13 Initial documentation of SAFE-M-30 mitigation Sachin Keswani
⚡