Systems, methods and apparatuses for device attestation based on speed of computation

Patent metadata

Field	Value
Publication number	US-11632248-B2
Application number	US-202117221576-A
Country	US
Kind code	B2
Filing date	Apr 2, 2021
Priority date	Mar 15, 2013
Publication date	Apr 18, 2023
Grant date	Apr 18, 2023

Abstract

The systems, methods and apparatuses described herein provide a computing device that is configured to attest itself to a communication partner. In one aspect, the computing device may comprise a communication port configured to receive an attestation request from the communication partner, and an application-specific integrated circuit (ASIC). The ASIC may be configured to receive the attestation request from the communication port. The attestation request may include a nonce generated at the communication partner. The ASIC may be further generate a verification value and send the verification value to the communication port to be transmitted back to the communication partner. The verification value may be a computation result of a predefined function taking the nonce as an initial value. In another aspect, the communication partner is configured to attest the computing device using speed of computation attestation.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, from a server via a communication port of a computer, an attestation request, wherein the attestation request includes a nonce generated at the server;
determining, by the computer, that a computer program being executed by a processor of the computer is digitally signed by a trusted third-party;
executing, by the computer, an attestation instruction executable by the processor responsive to the determination that the computer program being executed by the processor is digitally signed by the trusted third-party, wherein the attestation instruction instructs the computer to perform an attestation process, and wherein access to the attestation instruction is restricted to programs signed by the third-party;
generating, by the processor when executing the attestation instruction, a verification value, wherein the verification value is a computation result of a predefined function taking the nonce as an initial value; and
sending, by the computer, the verification value to the server via the communication port.

2. The method of claim 1 , further comprising obtaining, by the computer, a round-trip time for communication between the computer and the server.

3. The method of claim 2 , further comprising selecting, by the computer, at least one computation parameter for generating the verification value based on the round-trip time.

4. The method of claim 3 , wherein the at least one computation parameter includes a number of iterations for the particular predefined function to be performed by the computer.

5. The method of claim 1 , wherein the predefined function comprises at least one of an encryption function and a cryptographic hash function.

6. The method of claim 1 , further comprising capturing, by the computer, additional data comprising at least one intermediate result of computation of the predefined function.

7. The method of claim 6 , wherein the predefined function includes a sequence of operations performed in series, and wherein an output of a previous step in the sequence is an input of a next step in the sequence.

8. The method of claim 7 , wherein the at least one intermediate result comprises a first intermediate result of a first operation in the sequence of operations and a second intermediate result of a second operation in the sequence of operations.

9. The method of claim 7 , further comprising obtaining, by the computer, from the attestation request a number of iterations for the sequence of operations.

10. The method of claim 9 , wherein each step of the sequence of operations is an operation that starts its computation with all bits of an input value, and wherein all bits of its computation result are obtained simultaneously.

11. The method of claim 7 , wherein the sequence of operations includes cryptographic hash functions and/or encryption functions.

12. A computing device comprising:
a communication port configured to communicate data with a server; and
a processor configured to:
receive an attestation request from a server via the communication port, wherein the attestation request includes a nonce generated at the server;
determine that a computer program being executed by a processor of the computer is digitally signed by a trusted third-party;
execute an attestation instruction responsive to the determination that the computer program being executed by the processor is digitally signed by the trusted third-party, wherein the attestation instruction instructs the processor to perform an attestation process, and wherein access to the attestation instruction is restricted to programs signed by the third-party;
generate a verification value, wherein the processor is programmed to generate the verification value when executing the attestation instruction, and wherein the verification value is a computation result of a predefined function taking the nonce as an initial value; and
send the verification value to the server via the communication port.

13. The computing device of claim 12 , wherein the processor is further configured to obtain a round-trip time for communication between the computing device and the server.

14. The computing device of claim 13 , wherein the processor is further configured to select at least one computation parameter for generating the verification value based on the round-trip time.

15. The computing device of claim 14 , wherein the at least one computation parameter includes a number of iterations for the particular predefined function to be performed by the computer.

16. The computing device of claim 12 , wherein the predefined function is at least one of an encryption function and a cryptographic hash function.

17. The computing device of claim 12 , wherein the processor is further configured to capture additional data comprising at least one intermediate result of computation of the predefined function.

18. The computing device of claim 17 , wherein the predefined function includes a sequence of operations performed in series, and wherein an output of a previous step in the sequence is an input of a next step in the sequence.

19. The computing device of claim 18 , wherein the at least one intermediate result comprises a first intermediate result of a first operation in the sequence of operations and a second intermediate result of a second operation in the sequence of operations.

20. The computing device of claim 18 , wherein the processor is further configured to obtain from the attestation request a number of iterations for the sequence of operations.

21. The computing device of claim 20 , wherein each step of the sequence of operations is an operation that starts its computation with all bits of an input value, and wherein all bits of its computation result are obtained simultaneously.

22. The computing device of claim 18 , wherein the sequence of operations includes cryptographic hash functions and/or encryption functions.

Assignees

• Ologn Technologies Ag

Inventors

• Ignatchenko Sergey

Classifications

• H04L63/126

  the source of the received data · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L9/3234 Primary

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04W12/61

  Time-dependent · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title