Attestation verifier role delegation

Patent metadata

Field	Value
Publication number	US-12375488-B2
Application number	US-202118008743-A
Country	US
Kind code	B2
Filing date	Jul 7, 2021
Priority date	Jul 8, 2020
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

Various examples of device and system implementations and methods for performing attestation delegation operations are disclosed. In an example, attestation operations are performed by a verifier, including: obtaining endorsement information for attestation of an entity; obtaining an appraisal policy for evaluation of attestation evidence for the attestation of the entity; determining, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity; and providing, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations (e.g., verifier operations) for a domain of entities including the entity.

First claim

What is claimed is:

1. A computing device to operate as a lead attestation verifier for an attestation procedure, the computing device comprising:
at least one memory;
instructions in the computing device; and
processing circuitry to execute the instructions to perform attestation delegation operations that:
obtain endorsement information for attestation of an entity;
obtain an appraisal policy for evaluation of attestation evidence for the attestation of the entity;
determine, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity, wherein the delegate verifier entity is another computing entity configured as a verifier endorsee of the attestation procedure; and
provide, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations with the attestation procedure for a domain of entities including the entity, and wherein the attestation procedure establishes a trusted context among the domain of entities to perform computing operations;
wherein the attestation delegation operations are performed by a verifier having a root of trust established in secure hardware of the computing device.

2. The computing device of claim 1 , wherein the delegation command is provided to the delegate verifier entity in a defined format over a secure communication link.

3. The computing device of claim 2 , wherein the defined format is a Concise Binary Object Representation (CBOR) data format.

4. The computing device of claim 1 , wherein the computing device and the another computing entity communicate via a network or bus.

5. The computing device of claim 1 , wherein the processing circuitry of the computing device is further to execute the instructions to perform trust establishment of the delegate verifier entity with operations that:
obtain additional attestation evidence from the delegate verifier entity;
obtain attestation results from appraisal of the attestation evidence;
perform a delegation decision on the additional attestation evidence and the attestation results, the delegation decision to enable a delegation of attestation functions to the delegate verifier entity; and
communicate the delegation decision to the delegate verifier entity.

6. The computing device of claim 1 ,
wherein the endorsement information is provided from endorser entities in one or more encoded formats, the endorsement information being decoded into a common format for evaluation; and
wherein the appraisal policy is provided from a verifier owner entity in one or more encoded formats, the appraisal policy being decoded into a common format for evaluation.

7. The computing device of claim 1 , wherein the processing circuitry of the computing device is further to execute the instructions to perform attestation evaluation operations for a second entity, with operations that:
obtain evidence from one or more attesters regarding the second entity;
apply the endorsement information and the appraisal policy for evidence, to the evidence from the one or more attesters; and
communicate attestation results for the second entity to a relying party.

8. The computing device of claim 7 , wherein the attestation results are encoded according to a defined format.

9. The computing device of claim 7 , wherein the relying party determines validity of the attestation results based on an appraisal policy for attestation results provided from a relying party owner, and wherein the appraisal policy for attestation results is provided in a defined format.

10. The computing device of claim 7 , wherein the evidence from the one or more attesters is provided in one or more formats, and wherein the evidence is decoded into a common format for evaluation.

11. The computing device of claim 1 , wherein the delegate verifier entity is another entity implemented in hardware of the computing device.

12. A method performed by a computing device to operate as a lead attestation verifier for an attestation procedure, the method performing attestation delegation operations executed with a processor and memory of the computing device, the method comprising:
obtaining endorsement information for attestation of an entity;
obtaining an appraisal policy for evaluation of attestation evidence for the attestation of the entity;
determining, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity, wherein the delegate verifier entity is another computing entity configured as a verifier endorsee of the attestation procedure; and
providing, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations with the attestation procedure for a domain of entities including the entity, and wherein the attestation procedure establishes a trusted context among the domain of entities to perform computing operations;
wherein the attestation delegation operations are performed by a verifier having a root of trust established in secure hardware of the computing device.

13. The method of claim 12 , wherein the delegation command is provided to the delegate verifier entity in a defined format over a secure communication link.

14. The method of claim 13 , wherein the defined format is a Concise Binary Object Representation (CBOR) data format.

15. The method of claim 12 , wherein the computing device and the another computing entity communicate via a network or bus.

16. The method of claim 12 , the method further comprising performing trust establishment of the delegate verifier entity, with operations comprising:
obtaining additional attestation evidence from the delegate verifier entity;
obtaining attestation results from appraisal of the attestation evidence;
performing a delegation decision on the additional attestation evidence and the attestation results, the delegation decision to enable a delegation of attestation functions to the delegate verifier entity; and
communicating the delegation decision to the delegate verifier entity.

17. The method of claim 12 ,
wherein the endorsement information is provided from endorser entities in one or more encoded formats, the endorsement information being decoded into a common format for evaluation; and
wherein the appraisal policy is provided from a verifier owner entity in one or more encoded formats, the appraisal policy being decoded into a common format for evaluation.

18. The method of claim 12 , the method further comprising performing attestation evaluation operations for a second entity, with operations comprising:
obtaining evidence from one or more attesters regarding the second entity;
applying the endorsement information and the appraisal policy for evidence, to the evidence from the one or more attesters; and
communicating attestation results for the second entity to a relying party.

19. The method of claim 18 , wherein the attestation results are encoded according to a defined format.

20. The method of claim 18 , wherein the relying party determines validity of the attestation results based on an appraisal policy for attestation results provided from a relying party owner, and wherein the appraisal policy for attestation results is

Assignees

• Intel Corp

Inventors

• Smith Ned M
• Wang Junyuan
• Guo Kaijie
• Fan Zijuan
• Li Weigang
• Zhang Lihui

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title