Systems, methods and apparatuses for device attestation based on speed of computation

Patent metadata

Field	Value
Publication number	US-11722308-B2
Application number	US-202117322505-A
Country	US
Kind code	B2
Filing date	May 17, 2021
Priority date	Mar 15, 2013
Publication date	Aug 8, 2023
Grant date	Aug 8, 2023

Abstract

The systems, methods and apparatuses described herein provide a computing device that is configured to attest itself to a communication partner. In one aspect, the computing device may comprise a communication port configured to receive an attestation request from the communication partner, and an application-specific integrated circuit (ASIC). The ASIC may be configured to receive the attestation request, which may include a nonce. The ASIC may be further configured to generate a verification value, capture data representing a state of computation of the ASIC when the verification value is being generated, and send the verification value and captured data to the communication port to be transmitted back to the communication partner. The verification value may be a computation result of a predefined function taking the nonce as an initial value. In another aspect, the communication partner may be configured to attest the computing device using speed of computation attestation.

First claim

What is claimed is:

1. A computing device for attesting a communication partner comprising:
a communication port; and
a processor configured to:
obtain a nonce;
generate an attestation request including the nonce;
send the attestation request to a communication partner via the communication port;
receive a verification value from the communication partner, wherein the verification value is a computation result of a predefined function performed on the communication partner taking the nonce as an input value;
apply an inverse function to the verification value received from the communication partner, wherein the inverse function is an inverse operation of the predefined function;
determine whether an output of the inverse function is equal to the nonce sent in the attestation request; and
determine that the communication partner is a trusted device if the output of the inverse function is equal to the nonce sent in the attestation request.

2. The computing device of claim 1 , wherein the processor is further configured to:
determine whether the verification value is received within a predetermined time threshold; and
determine that the communication partner is a trusted device if the verification value is received within the predetermined time threshold.

3. The computing device of claim 2 , wherein to determine whether the verification value is received within the predetermined time threshold, the processor is further configured to:
determine a first time upon transmitting the nonce to the communication partner; and
determine a second time upon receiving the verification value from the communication partner, wherein the processor determines whether the verification value is received within the time threshold based on a difference between the first time and the second time.

4. The computing device of claim 3 , wherein the time threshold is based on one or more expected times, and wherein at least one expected time is selected from the group comprising: an expected time for transmitting the nonce from the computer to the communication partner, an expected time for the communication partner to calculate the verification value, and an expected time for the communication partner to transmit the verification value to the computer.

5. The computing device of claim 1 , wherein the predefined function includes a sequence of operations performed in series, and wherein an output of a previous step in the sequence is an input value of a next step in the sequence.

6. The computing device of claim 5 , wherein the sequence of operations includes at least one of a cryptographic hash function and an encryption function.

7. The computing device of claim 5 , wherein the attestation request includes a number of iterations for the predefined function to be repetitively performed at the communication partner to generate the verification value.

8. The computing device of claim 1 , wherein the predefined function is a symmetric encryption function, and wherein the verification value is obtained from computation of the predefined function using an encryption key and the nonce as the input value.

9. The computing device of claim 8 , wherein the processor is further configured to transmit the encryption key to the communication partner via the communication port.

10. The computing device of claim 1 , wherein the processor is further configured to:
receive at least a first intermediate result and a second intermediate result of computation of the predefined function performed on the communication partner;
determine whether the first intermediate result is equal to a first expected value by performing the predefined function taking the nonce as a first input value;
determine whether the second intermediate result is equal to a second expected value by performing the predefined function taking the first intermediate result as a second input value; and
determine that the communication partner is a trusted device if the first intermediate result is equal to the first expected value and the second intermediate result is equal to the second expected value.

11. The computing device of claim 10 , wherein the processor is configured to determine in parallel whether each of the first intermediate result and the second intermediate result is equal to each of the first expected value and the second expected value respectively.

12. A computer-implemented method of attesting a communication partner, the method comprising:
generating, by a computer, an attestation request including a nonce;
transmitting, by the computer, the attestation request to a communication partner via a communication port of the computer;
receiving, by the computer, a verification value from the communication partner, wherein the verification value is a computation result of a predefined function performed on the communication partner taking the nonce as an input value;
applying, by the computer, an inverse function to the verification value received from the communication partner, wherein the inverse function is an inverse operation of the predefined function;
determining, by the computer, whether an output of the inverse function is equal to the nonce sent in the attestation request; and
determining, by the computer, that the communication partner is a trusted device if the output of the inverse function is equal to the nonce sent in the attestation request.

13. The computer-implemented method of claim 12 , the method further comprising:
determining, by the computer, whether the verification value is received within a predetermined time threshold; and
determining, by the computer, that the communication partner is a trusted device if the verification value is received within the predetermined time threshold.

14. The computer-implemented method of claim 13 , wherein determining whether the verification value is received within the predetermined time threshold comprises:
determining, by the computer, a first time upon transmitting the nonce to the communication partner; and
determining, by the computer, a second time upon receiving the verification value from the communication partner, wherein the processor determines whether the verification value is received within the time threshold based on a difference between the first time and the second time.

15. The computer-implemented method of claim 14 , wherein the time threshold is based on one or more expected times, and wherein at least one expected time is selected from the group comprising: an expected time for transmitting the nonce from the computer to the communication partner, an expected time for the communication partner to calculate the verification value, and an expected time for the communication partner to transmit the verification value to the computer.

16. The computer-implemented method of claim 12 , wherein the predefined function includes a sequence of operations performed in series, and wherein an output of a previous step in the sequence is an input value of a next step in the sequence.

17. The computer-implemented method of claim 16 , wherein the sequence of operations includes at least one of a cryptographic hash function and an encryption function.

18. The computer-implemented method of claim 16 , wherein the attestation request includes a number of iterations for the predefined function to be repetitively performed at the communication partner to generate the verification value.

19. The computer-implemented method of claim 12 , wherein the predefined function is a symmetric encryption function, and whe

Assignees

• Ologn Technologies Ag

Inventors

• Ignatchenko Sergey

Classifications

• H04L9/3234 Primary

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L63/126

  the source of the received data · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04W12/61

  Time-dependent · CPC title