Hierarchical physics-grounded birth certificate system with multi-domain evidence fusion and safety-constrained graduated enforcement

Abstract

A method of detecting threats in a monitored computing system through comparison with stored baseline measurements. In an enrolment phase, baseline measurements are collected from a plurality of obser

Description

Applicant: Dean Crilly FIELD OF THE INVENTION The present invention relates to integrity verification systems for monitored computing and physical systems, and more particularly to systems and methods for establishing hierarchical physics-grounded baselines, continuously verifying system behaviour against enrolled baselines through multi-domain independent evidence collection, producing structured verdict states from conflict-aware evidence fusion, and executing enforcement actions constrained by safety and operational domain profiles. BACKGROUND OF THE INVENTION Hardware attestation and device identity systems are known. Intel Trust Authority provides flat TEE policy attestation based on cryptographic keys within trusted execution environments. The Trusted Computing Group's DICE (Device Identifier Composition Engine) architecture provides layered firmware identity derivation where each layer computes a certificate based on the measurement of the next layer. ARM Platform Security Architecture provides single-layer attestation for ARM devices. Azure Confidential Computing and AWS Nitro provide hardware-backed workload isolation with attestation. Physical Unclonable Functions provide manufacturing-time device identity based on intrinsic silicon variations. Device identity and lifecycle management systems are known. Micron Technology (Shiner et al., multiple US Patent Applications 2022) has described secure memory device-based endpoint identity validation using cryptographic secrets stored in the memory device. Somos Inc. (Brazao et al., multiple US Patent Applications 2022) has described Internet of Things device registry systems using unigue device identifiers with trust rating computation. Mocana / DigiCert (Kumar et al., US Patent Application 2019 / 0166116) has described device identification for enrollment and registration using authenticated identity beacons and certificate-based validation. Ericsson (WO 2020 / 249245) has described loT Trustworthiness as a Service using digital certification proofs. US Patent 10,911,248 has described flat manufacturing identity for devices without hierarchy or continuous verification. Multi-source evidence fusion theories are known. Dempster-Shafer theory provides a mathematical framework for combining evidence from multiple sources. The proportional conflict redistribution rules address the Zadeh paradox that arises when highly conflicting evidence sources are combined using Dempster's rule. Protocol architectures for secure communication are well established. TLS 1.3 (RFC 8446) provides encrypted transport with capability negotiation. DNSSEC provides hierarchical trust delegation for domain name resolution. The OSI seven-layer model and TCP / IP four-layer model demonstrate the principle of layered protocol architectures with clear interface boundaries. Limitations of the prior art. No existing attestation system uses hardware physics measurements - power consumption profiles, micro-architectural event patterns, thermal characteristics, DRAM jitter distributions, interconnect bandwidth ratios -as identity evidence. All existing systems use cryptographic keys, firmware hashes, or manufacturing-time PUF responses. No existing system captures per-component physics baselines during a controlled enrollment ceremony and composes them into a hierarchical structure anchored in dual Merkle trees. No existing system produces twelve formal verdict states from the cross-correlation of physics evidence, identity baselines, and software event testimony. No existing system implements a corroboration debt mechanism reguiring cross-domain physics corroboration to release high-severity anomalies. No existing system provides a domain-agnostic protocol that separates the method of integrity verification from domain-specific measurement adapters, enabling the same protocol to be applied across cybersecurity, energy grid, medical device, autonomous vehicle, and other domains. No existing system defines safety-constrained domain profiles that limit enforcement actions based on the operational domain - for example, preventing automated isolation of a medical device that is actively supporting patient care. The present invention addresses these limitations. DETAILED DESCRIPTION OF THE INVENTION Technical Problem In systems monitored by multiple sensors - including computing networks, electrical power infrastructure, structural assets, and medical devices - the monitored system or an adversary may compromise, tamper with, or fabricate measurements from one or more of the sensors on which integrity assessment depends. Existing monitoring systems assume that sensor data is trustworthy, and produce incorrect assessments when this assumption is violated. The technical problem addressed by the present invention is: how to detect when one or more sensors or observation domains have been compromised or are producing fabricated measurements, and how to produce reliable integrity assessments despite the presence of compromised sensors, without reguiring the monitoring system to know in advance which sensors may be compromised. This is a sensor reliability problem under adversarial conditions, analogous to fault-tolerant avionics systems that must produce reliable flight data despite individual sensor failures, but extended to the case where sensor failures may be deliberately induced by an adversary rather than arising from natural degradation. The present invention solves this technical problem through a chain of specific technical operations: (a) establishing physics-grounded baselines during controlled enrollment conditions and anchoring them in cryptographic Merkle tree structures; (b) collecting continuous measurement data from multiple physically independent observation domains operating on independent hardware with independent signing keys; (c) detecting inter-domain disagreement via mathematical distance measures and automatically discounting outlier domains; (d) fusing the remaining evidence using conflict-aware combination rules that adapt their mathematical behaviour based on measured inter-source conflict; (e) producing structured integrity assessment signals from the fused evidence; and (f) executing enforcement actions on physical actuators constrained by safety and operational domain profiles. Each step in this chain reguires specific computational operations that cannot be performed manually and each produces a specific technical effect. 1. Overview - Verifiable Evidence over Unverifiable Claims The present invention provides a domain-agnostic protocol for verifying the integrity of monitored systems. The protocol is founded on the principle that in any monitored system, there exist two classes of information: self-reported claims that the system can fabricate, and independently measurable physical evidence that the system cannot control. The protocol trusts the latter over the former. The protocol defines the METHOD for integrity verification. Domain-specific implementations provide ADAPTERS that connect the protocol to specific measurement hardware, specific enforcement mechanisms, and specific operational constraints. The same protocol applies whether the monitored system is a computing device in an enterprise network, a sensor on an electrical grid, a medical infusion pump, an autonomous vehicle controller, or a satellite communication system. Each domain connects different sensors and different enforcement mechanisms to the same protocol layers. The protocol operates on technical means - hardware sensors, network interfaces, cryptographic processors, and enforcement actuators. It produces technical effects - security verdicts, enforcement actions, cryptographically sealed evidence, and graduated trust management. The inventive contribution lies in the specific protocol architecture, the hierarchical birth certificate structure, the twelve verdict state taxonomy, the corroboration debt mechanism, the capability negotiation handshake, the domain profile safety constraints, and the trust delegation hierarchy - not in the abstract principle of trusting physics over software. 2. Protocol Stack - Six Core Layers [See Figure 1: Six-Layer Protocol Stack in the Drawings] The protocol comprises six core layers and two optional extensions. Each layer boundary satisfies at least one of five conditions: a change of trust domain, a hardware / software boundary, an administrative domain transition, a rate-of-change differential between adjacent functions, or independent replaceability of the layer's implementation. Layer 1: Enrollment and Discovery. The protocol establishes the integrity baseline -what "honest" looks like for each monitored system. During a controlled enrollment ceremony, the protocol discovers hardware components, measures their physics under standardised workloads, and creates the hierarchical birth certificate. The enrollment ceremony comprises five phases: Phase 1 - Hardware verification: the monitored device is connected to an isolated network segment, a multi-party guorum (default two-of-three administrators) verifies physical identity, and standardised workloads are executed while all physics modalities are recorded. Phase 2 - Software burn-in: the normal software stack is deployed and monitored for a configurable period (default seven days), during which per-process and per-service physics profiles are captured. Phase 3 -Network integration: the device is connected to the production network in a MONITORED state with elevated monitoring thresholds for a configurable period (default thirty days). Phase 4 - Composite sealing: all component and software birth certificates are composed into a device composite certificate, digitally signed using Ed25519ctx with domain-separated context strings, and anchored in dual Merkle trees. Phase 5 - Seasonal learning: the system captures weekly, monthly, and guarterly operational patterns over a configurable period (default ninety days) to build comprehensive baseline profiles. In a preferred embodiment, each newly enrolled birth certificate is cross-referenced against the fleet's existing birth certificate population for the same hardware model. A new enrollment whose physics profile is statistically anomalous relative to the same-model fleet distribution - as measured by Mahalanobis distance exceeding a configurable threshold - is flagged for human review before the birth certificate is accepted. This fleet cross-validation provides a statistical safeguard against the most dangerous attack surface in the architecture: enrollment ceremony compromise. Layer 2: Observation. The protocol collects verifiable evidence from multiple physically independent observation domains. Each domain operates on independent hardware with independent cryptographic signing keys. Temporal synchronisation uses Network Time Security (RFC 8915) combined with Lamport logical timestamps for causal ordering. Each observation message carries an Ed25519ctx signature independent of any transport-layer encryption. During transport unavailability, observations are buffered in a locally signed ring buffer. The protocol specifies a transport interface, not a transport implementation - any durable message delivery system satisfying the interface reguirements (ordered delivery, at-least-once semantics, persistence) is conformant. In a further embodiment, the independent wire observation device performs continuous self-attestation by comparing its own observations against what the other observation layers indicate should be happening. The sustained absence of expected observations given activity reported by other layers - detected by applying cumulative sum absence detection to the observation device's own stream -indicates possible observation device compromise or network path manipulation. Layer 3: Analysis and Fusion. The protocol evaluates collected evidence, fuses it using conflict-aware combination rules, and produces structured verdicts. The analysis pipeline processes each observation through the following stages: Anomaly scoring uses the Mahalanobis distance between current measurement vectors and enrolled baselines: D_M(t) = sgrt((r(t) - po)T So-1 (r(t) - po)), where r(t) is the current measurement vector, po is the enrollment mean, and So is the enrollment covariance matrix. The normalised anomaly score is derived via the chi-sguared cumulative distribution function. Topological data analysis via persistent homology is performed in three computation tiers: edge-level Mahalanobis only, neural approximation on NPU for flagged readings, and full Vietoris-Rips persistent homology on GPU for confirmed anomalies. Cumulative sum detection monitors for expected event absence. Birth certificate comparison uses debiased Sinkhorn divergence on persistence diagrams. Conformal prediction provides calibrated p-values. Basic Belief Assignments are constructed over a frame of discernment {AUTHENTIC, SUSPECT, TAMPERED}. Outlier detection uses Jousselme distance between all domain pairs: dj(mi, mJ) = sqrt(y2 (m i - mJ)T D (m i - mJ)), where D is the Jaccard similarity matrix over the power set elements. A domain whose average Jousselme distance from all other domains exceeds a threshold is identified as an outlier and its evidence is discounted. Adaptive fusion rule selection applies Dempster's rule for low inter-source conflict, Murphy's averaging for medium conflict, and proportional conflict redistribution rule 6 with vacuous belief assignment neutrality fix for high conflict. The final verdict is derived via pignistic probability transformation and selected from twelve states. An internal interface between the analysis and verdict stages is mandatory, enabling independent tuning of the analysis pipeline and the verdict classification. Layer 4: Correlation. The protocol links individual device verdicts to detect coordinated integrity violations across a fleet. A graph neural network operating on the fleet topology with physics-derived node features detects cross-device patterns. Kill chain detection identifies multi-step attack sequences via temporal pattern matching. Campaign hypothesis generation via a language model adapted on domain-specific data produces natural language descriptions of detected campaigns. Layer 5: Enforcement and Remediation. The protocol executes proportional defensive actions constrained by the applicable domain profile. The observation domains are physically and operationally independent such that compromise of one domain does not enable control or fabrication of measurements in another domain. This physical independence is the foundational security property of the protocol. The trust state machine defines states: UNKNOWN, ENROLLING, PROVISIONED, MONITORED, SOVEREIGN, DEGRADED, SUSPICIOUS, QUARANTINED, BURNED, and DECOMMISSIONED. Trust decays over time according to a power-law function: r(t) = to(1 + At / T_half)'K(-a) unless refreshed by continued compliance with birth certificate baselines. Active defences include traffic misdirection, state inconsistency detection, and irreversible isolation requiring multi-domain consensus. Concrete enforcement actions include: switch port shutdown isolating a device from the network, VLAN reassignment moving a device to a quarantine segment, traffic rate limiting, firewall rule insertion blocking specific patterns, circuit breaker trip confirmation for power grid domains, and alert-only notification for medical device domains. Mandatory alert aggregation limits actionable alerts to a configurable maximum (default ten per day) to prevent analyst fatigue. Low and medium severity events are auto-remediated with human notification. A feedback loop auto-tunes detection thresholds based on operational false positive rates. Spoofing cost function. The protocol provides a quantifiable security guarantee: for each independent observation domain i, the system estimates a per-domain spoofing cost C i. The aggregate cost for simultaneously defeating all n domains is C total = n(CJ) for i = 1 to n, reflecting the physical independence requirement that spoofing difficulty grows multiplicatively with each additional domain. Layer 6: Evidence and Sharing. The protocol produces tamper-evident evidence records and enables cross-organisation intelligence sharing. Evidence objects are cryptographically sealed containers carrying physics measurements, self-reported testimony, birth certificate comparison results, detection verdicts, Ed25519ctx signatures, and Merkle tree proofs. Dual Merkle trees (device-local and fleet-wide) provide tamper-evident anchoring. Storage sifting discards verified-clean raw telemetry (where all layers agreed against the birth certificate that the reading was clean) and retains full-fidelity evidence for non-clean verdicts. Cross-organisation sharing uses differential privacy on persistence diagrams. Crypto-shredding (destroying per-device encryption keys) enables data subject deletion compliance. Extension A: Calibration. An optional layer between Observation and Analysis for environments where operating conditions affect physics baselines - deep-sea installations, space systems, outdoor deployments, and data centres with variable cooling. The calibration layer normalises current readings against current environmental context before comparison to birth certificate baselines. Extension B: Governance. An optional meta-layer providing protocol versioning, adapter certification, dispute resolution, and compliance auditing. Modelled on DNSSEC root zone trust anchor management, enabling hierarchical governance of trust delegation across organisational boundaries. 3. Domain Profiles - Safety-Constrained Enforcement [See Figure 3: Domain Profile Safety Constraints in the Drawings] The protocol defines domain profiles that constrain enforcement actions based on safety and operational reguirements: HVP-Enterprise: Full enforcement including irreversible isolation. Minimum four observation domains. Default profile for enterprise computing environments. HVP-Medical: Alert only - no automated enforcement actions that could disrupt patient care. Minimum two observation domains. Safety constraint: automated isolation of a medical device actively supporting a patient is prohibited; the system generates alerts for human decision. HVP-Constrained: Alert plus rate-limiting. Minimum two observation domains. For Internet of Things devices, embedded systems, and resource-limited devices that cannot host full observation agents. HVP-Sovereign: Local verdict generation only, without reguiring network connectivity. Minimum two observation domains. For disconnected environments including autonomous underwater vehicles, spacecraft, and field-deployed devices. HVP-Adversarial: Full enforcement plus external oracle validation. Minimum four observation domains plus at least one external oracle. For environments where the adversary may have advanced persistent access to infrastructure. 4. Hierarchical Birth Certificate Architecture [See Figure 2: Hierarchical Birth Certificate Architecture in the Drawings] The birth certificate architecture organises physics baselines into five hierarchical levels, each composed from the level below via cryptographic Merkle tree composition: Level 1 - Component (Silicon). Every hardware component receives its own physics-grounded certificate capturing measurements from the enrollment ceremony. Certificates store per-workload physics profiles measured under standardised conditions, including power consumption response curves, performance counter baselines, thermal response trajectories, and timing characteristics. Two measurement tiers are distinguished: unforgeable measurements based on manufacturing variation (physically unclonable function responses, Rowhammer-induced bit flip fingerprints) and behavioural measurements based on operational characteristics (power consumption, thermal response) that are distinctive but theoretically spoofable. Level 2 - Process / Service (Software). Per-process and per-service certificates capture expected physics profiles during normal operation. Directory service object certificates capture security-relevant attributes. Identity provider configurations, certificate authority structures, and wireless access point profiles are captured at this level. Level 3 - Device Composite. A composite certificate signed as: Sign(Hash(hardware_root || softwareroot || identityroot || confighash || timestamp), signing key). The composite cryptographically binds the hardware, software, and identity baselines into a single verifiable unit. Level 4 - Network Fleet. A graph neural network-maintained temporal heterogeneous graph representing the fleet topology with physics-derived node features and Poincare ball embeddings. Level 5 - Organisation. Organisation-wide infrastructure topology, trust delegation hierarchy, compliance posture, and policy configuration. Birth certificate storage. Birth certificates are stored in multiple locations to enable both local operation and fleet-wide verification. The monitored system maintains a local encrypted copy of its birth certificate (Levels 1-3) on persistent storage, enabling local baseline comparison during disconnected or headless operation. The central verification server maintains the authoritative copy of all birth certificates and both Merkle trees (device-local and fleet-wide), enabling fleet-wide correlation and cross-device comparison. Independent observation devices maintain their own copies of the observation baselines relevant to their measurement domain. During enrollment, the birth certificate is generated on the central verification server and distributed to the monitored system and the relevant observation devices. The dual Merkle tree roots are co-signed by multiple independent parties for split-view protection. Structural divergence diagnosis. The hierarchical structure enables component-level diagnostic resolution from over 127 distinct divergence patterns, at least 8 of which are unigue to the hierarchical approach and impossible for flat (non-hierarchical) certificate systems to distinguish. A CPU-only divergence indicates a compute attack. A NIC-only divergence indicates a network implant. An NVMe-only divergence indicates storage firmware compromise. Multiple hardware component divergences simultaneously indicate hardware substitution. Process-only divergence indicates a software attack. Directory service-only divergence indicates an identity attack. Each pattern reguires a different remediation response. Self-healing certificates. Birth certificates adapt to legitimate operational changes through a three-stage pipeline: online CUSUM for real-time detection of baseline changes, offline PELT (Pruned Exact Linear Time) for globally optimal changepoint detection, and classification of each detected change: gradual drift triggers automatic baseline update; a step change accompanied by an authorised change ticket triggers streamlined re-enrollment; a step change at Level 1 (hardware) triggers enhanced re-enrollment with full ceremony; a step change without correlation to any authorised activity triggers FREEZE (possible attack); accelerating drift without apparent cause triggers ALERT (detecting a slow-drift "boiling frog" attack). 5. Twelve Verdict States The protocol produces integrity verdicts selected from twelve states derived from the combinatorial evaluation of three dimensions: physical evidence (normal or anomalous), birth certificate comparison (match or mismatch), and self-reported testimony (present+consistent, present-i-inconsistent, or absent). States include: VERIFIED CLEAN (all dimensions normal), NARRATIVE INJECTION (physics normal but testimony inconsistent), SILENT IDLE (physics normal but testimony absent), IDENTITY DRIFT (physics normal but birth certificate mismatch), SOPHISTICATED SUBSTITUTION (physics normal, birth certificate mismatch, testimony inconsistent), GHOST MACHINE (physics normal, birth certificate mismatch, testimony absent), ENROLLED ANOMALY (physics anomalous, birth certificate match, testimony consistent), LOG TAMPERING (physics anomalous, testimony inconsistent), SILENT ACTIVE (physics anomalous, testimony absent), HIDDEN COMPROMISE (physics anomalous, birth certificate mismatch, testimony consistent), FULL COMPROMISE (all three dimensions abnormal), and TOTAL BLACKOUT (physics anomalous, birth certificate mismatch, testimony absent). States IDENTITY DRIFT, SOPHISTICATED SUBSTITUTION, GHOST MACHINE, SILENT ACTIVE, and TOTAL BLACKOUT are structurally impossible for systems operating on fewer than three independent evidence domains - they require the birth certificate dimension to produce the distinction. This structural impossibility for simpler architectures is a primary novelty of the twelve-state taxonomy. 6. Corroboration Debt The protocol implements a corroboration debt mechanism. When a single observation domain produces a high-severity anomaly verdict but no other domain corroborates, confidence in that verdict decays over time. Critically, time alone is never sufficient to release a high-severity anomaly - cross-domain corroboration from at least one additional physically independent domain is required. In a preferred embodiment, the decay rate is modulated by the aggregate anomaly state across the monitored fleet. The decay rate A(t) = A base x (1 + a x fleet anomaly score(t)), where A base is the default decay rate, a is a sensitivity parameter, and fleet anomaly score(t) is the mean normalised anomaly across all monitored entities. During elevated fleet-wide threat activity, uncorroborated events decay faster, reflecting increased prior probability that they represent genuine incidents. In an alternative embodiment, the corroboration debt model is implemented as a hidden Markov model wherein the hidden state represents the true integrity status (genuine-clean, genuine-compromised, or indeterminate), the observable emissions are individual per-domain verdict outputs, and transition probabilities encode temporal decay of uncorroborated evidence. The Viterbi algorithm identifies the most likely true integrity state trajectory over time. 6A. Inter-Domain Physics Disagreement Resolution When two or more physics observation domains produce measurements that are internally inconsistent with each other - for example, strain measurements indicating normal loading while vibration frequency measurements indicate stiffness degradation, or power consumption measurements indicating high computation while thermal measurements indicate normal temperature - the system treats the inter-physics disagreement as a potential integrity violation rather than merely a sensor calibration error. The system applies the same Jousselme distance outlier detection used for cross-domain fusion to identify which physics domain is the outlier. If one domain consistently disagrees with the majority of other physics domains, that domain's evidence is discounted and the domain is flagged for sensor integrity investigation. This mechanism detects both sensor degradation (where a failing sensor produces increasingly inaccurate readings) and sensor tampering (where an attacker spoofs one physics modality while the others remain honest). The cross-modality consistency check creates a web of mutual verification among the physics domains themselves, independent of the testimony and identity layers. 7. Capability Negotiation Handshake The protocol defines a one-round-trip capability negotiation handshake modelled on TLS 1.3 orthogonal negotiation. The initiating device transmits an InitiatorHello message containing: supported protocol versions, available observation interfaces, supported analysis methods, supported fusion rules, supported cryptographic algorithms, supported description language versions, a cryptographic nonce, and a speculative key share. The responding device transmits a ResponderHello message containing: selected capabilities from each category, a nonce incorporating anti-downgrade sentinel bytes, a key share, and a transcript signature covering the full handshake. Anti-downgrade protection comprises sentinel bytes embedded in the nonce, full transcript signing preventing message modification, strict message handling rejecting unexpected content, and GREASE (Generate Random Extensions And Sustain Extensibility) values to prevent ossification. The mandatory-to-implement baseline ensures interoperability: performance monitoring unit measurement, Mahalanobis distance analysis, PCR6 fusion, ML-DSA-44 signatures, and HVP-DL version 1.0. 8. Trust Delegation The protocol defines a hierarchical trust delegation model: a Root Enrollment Authority delegates to Regional Enrollment Authorities, which delegate to individual devices. Delegation certificates carry scope constraints (which devices or device classes the delegate may enroll), duration limits, and maximum trust level constraints (a delegate cannot grant higher trust than it holds). Delegation revocation flags enrolled devices for re-verification - revocation does not automatically burn enrolled devices but triggers elevated monitoring and scheduled re-enrollment. This model is analogous to the intermediate certificate authority hierarchy in PKI. 9. Description Language as Executable Measurement Configuration The protocol defines a structured description language (HVP-DL) that serves as a machine-readable measurement configuration protocol. Receiving an HVP-DL configuration causes the receiving system to physically configure and initiate measurement operations - the language tags are executable commands, not passive descriptions. The primary serialisation format is JSON. For constrained environments, CBOR (RFC 8949) with COSE (RFC 9052) signatures provides compact binary encoding. When a system receives a DEVICE tag containing a COMPONENT sub-tag with a RAPE measurement capability at a specified polling interval, the system configures the RAPE model-specific register access at that interval and initiates baseline power measurement. When a system receives a WORKLOAD tag, the system executes the specified computational workload and records the resulting physics measurements across all configured modalities. When a system receives a CEREMONY tag, the system initiates the multi-phase enrollment process specified in the tag, including hardware verification, software burn-in, network integration, composite sealing, and seasonal learning phases. The language defines 22 tags organised into core tags (DEVICE, COMPONENT, WORKLOAD, CERTIFICATE, OBSERVATION, RULE, ENFORCEMENT, MOTIF, ADAPTER, CEREMONY) and extended tags (COUPLING, THRESHOLD, FLEET, CAMPAIGN, DRIFT MODEL, TRUST POLICY, PRIVACY, INTEGRATION, SAFETY CONSTRAINT, REGULATORY, SWARM, MIGRATION). The language is forward-compatible (implementations ignore unknown tags) and backward-compatible (new tags do not change the semantics of existing tags). 10. Protocol Security Ed25519ctx domain separation. The protocol reguires Ed25519ctx (RFC 8032, Section 5.1) with unigue context strings per signature purpose: birth certificate signatures, measurement signatures, enforcement signatures, inter-layer signatures, evidence signatures, and heartbeat signatures. Separate key pairs are maintained per purpose. Key lifecycle. Keys progress through states: GENERATED ACTIVE ROTATING (with overlap period) RETIRED REVOKED (irreversible). Revocation propagates via CRL entries in the fleet-wide Merkle tree within one Merkle epoch. Post-guantum agility. The cryptographic algorithm is an adapter behind a signature interface. Current: Ed25519 + SHA-256. 2028: Composite ML-DSA-44 + Ed25519. 2032: Full ML-DSA. Merkle roots: SLH-DSA (hash-based, conservative). Merkle split-view protection. Multiple independent witnesses co-sign the fleet-wide Merkle root. A gossip protocol enables consistency verification. Domain-separated hashing (leaf prefix 0x00, node prefix 0x01, per RFC 9162) prevents second-preimage attacks. Maximum Merge Delay of 60 seconds limits the window for inconsistent views. Conformance testing. A test vector library in JSON format covers every handshake flow, negotiation scenario, verdict derivation, state machine transition, and error condition, including negative tests and known-answer tests for mathematical operations. Three conformance levels (Core, Standard, Advanced) enable progressive implementation. Error taxonomy. Seven error categories (Protocol 100-199, Authentication 200-299, Verification 300-399, Configuration 400-499, Transport 500-599, Enrollment 600-699, Internal 700-799). Authentication errors use a single generic external code to prevent oracle attacks. Verification errors never reveal which processing step failed. 11. Cross-Domain Application - Detailed Structural Health Monitoring Embodiment The system's domain-agnostic architecture is demonstrated through a fully described structural health monitoring embodiment and additional application sketches. Structural health monitoring of buildings and bridges (detailed embodiment). Structural health monitoring systems using sensors to measure physical parameters of structures and compare against baseline measurements are known in the art. The present invention applies the hierarchical birth certificate architecture, twelve-state verdict system, and multi-domain evidence fusion to this domain, providing capabilities not present in existing structural monitoring systems. A multi-storey reinforced concrete building is monitored using the HVP-Enterprise domain profile. The observation adapters at Layer 2 connect to the building's structural health monitoring sensor network: strain gauges on load-bearing columns and beams (measuring axial load, bending moment, and shear stress), accelerometers on each floor (measuring natural vibration freguency, mode shapes, and damping ratios), tilt sensors on the foundation (measuring differential settlement), crack gauges across known stress points (measuring crack width propagation rate), corrosion sensors on reinforcing steel (measuring corrosion potential and corrosion rate), moisture sensors in concrete (measuring water content and chloride penetration depth), and temperature sensors throughout the structure (measuring thermal gradient stress). During the enrollment ceremony (conducted during or immediately after construction, or during a comprehensive structural survey for existing buildings), all sensor modalities are recorded under controlled conditions - known loading (occupancy surveys, traffic counts for bridges), known environmental conditions (ambient temperature, wind loading, ground water level), and known structural state (verified by independent structural engineering assessment). The birth certificate captures: expected strain values at each instrumented location under service loading, expected natural freguencies and mode shapes (which change when structural stiffness degrades), expected settlement rates, baseline crack widths, baseline corrosion potentials, and the relationships between these measurements (for example, the expected relationship between temperature and thermal strain, or between wind speed and lateral acceleration). During monitoring, the system compares the structure's current physics against the enrolled birth certificate. A column whose strain readings have increased beyond the enrolled baseline - indicating that the column is carrying more load than its birth certificate predicts, potentially due to redistribution from a failing adjacent element - triggers a physics anomaly. A change in the building's natural vibration freguency without corresponding structural modification indicates stiffness degradation. Cross-correlation with the building's inspection records (the testimony layer) produces a Truth Sandwich verdict: if the strain gauges show progressive overloading but the inspection reports state "structure satisfactory," the inspection testimony is unreliable - the physics and the testimony disagree, producing a NARRATIVE INJECTION verdict. This embodiment directly addresses the failure mode demonstrated by the Champlain Towers South collapse (Surfside, Florida, June 2021), where structural distress - cracking, water intrusion, corrosion of reinforcing steel, concrete deterioration - was present for years before the collapse, documented in engineering reports but inadeguately acted upon. A system that continuously compared physics measurements against enrolled structural baselines and flagged discrepancies between physical reality and inspection testimony would have detected the progressive structural degradation and produced escalating verdicts as the deviation from the birth certificate increased over time. The enforcement architecture for structural monitoring generates alerts to structural engineers and building management with the full evidence chain. For bridge structures carrying traffic, the system can recommend load restrictions or closure when physics measurements exceed safety thresholds, but the enforcement is constrained to advisory actions - human structural engineers make the final decision on closure or evacuation. The regulatory framework includes building codes reguiring structural health monitoring for high-risk structures, and emerging standards for continuous structural monitoring in seismically active regions. 11-GRID. Power Grid Protection Relay Monitoring (Detailed Embodiment) A protection relay on a high-voltage transmission line is monitored using the HVP-Enterprise domain profile with additional human confirmation constraints for load-bearing breaker operations. The observation adapters at Layer 2 connect to the relay's physical measurement interfaces: voltage transformers (measuring line voltage at each phase), current transformers (measuring line current at each phase), freguency measurement (derived from voltage zero-crossings), phase angle (computed from voltage and current waveforms), and relay coil current (measuring the physical state of the trip coil). During the enrollment ceremony (conducted during relay commissioning or maintenance window), the relay operates under controlled conditions with known load profiles. The birth certificate captures the relay's expected measurement accuracy under standard conditions, its expected response time from fault detection to trip signal, the expected coil current profile during a trip operation, and the expected thermal characteristics of the relay housing under rated load. During monitoring, the system compares the relay's physics against the enrolled birth certificate. A relay whose voltage measurement drifts beyond the enrolled accuracy baseline - potentially indicating a compromised voltage transformer or a spoofed measurement injected into the relay's input - triggers a physics anomaly. A relay whose trip response time degrades beyond the enrolled baseline indicates either mechanical wear or firmware tampering. Cross-correlation with the relay's self-reported status via its IEC 61850 GOOSE (Generic Object-Oriented Substation Event) messages produces a Truth Sandwich verdict: if the relay reports a fault but the physics measurements from independent current transformers show no fault current, the relay's fault report is unreliable - potentially indicating a spoofed trip attempt that could cause an unnecessary blackout. The enforcement architecture for power grid protection reguires human confirmation before automated circuit breaker operations on load-bearing circuits. The system generates alerts to grid control room operators with the full evidence chain - physics measurements, birth certificate comparison, and relay self-reported status - enabling operators to make informed decisions about whether to trust or override the relay's protection function. This enforcement constraint reflects the domain reality that a false trip on a 400kV transmission line can cascade into a regional blackout affecting millions of people. The regulatory driver is NERC CIP-015-1 (Internal Network Security Monitoring), which reguires monitoring of internal communications for anomalous activity in bulk electric system cyber systems, with enforcement beginning October 2028. The present invention directly addresses NERC CIP-015-1 reguirements RI (monitoring), R2 (data retention via evidence objects), and R3 (data integrity via Merkle-anchored cryptographic evidence chains). Additional cross-domain application sketches. Medical device monitoring uses the HVP-Medical domain profile where automated enforcement is limited to alerts only - the enforcement subsystem physically cannot issue a stop command to a device flagged with a safety constraint, preventing automated actions that could disrupt patient care. Autonomous vehicle monitoring connects to LiDAR, IMU, GPS, and vehicle bus interfaces, with enforcement limited to safe-stop procedures under the HVP-Sovereign profile. Data centre GPU cluster monitoring connects to CXL fabric counters and NVLink interconnect monitors. Satellite monitoring operates with local verdict generation during communication blackouts. Mobile phone monitoring operates under the HVP-Constrained profile with reduced modality sets. 11B. Observation Adapters with Local Intelligence In a preferred embodiment, each observation adapter connecting domain-specific sensors to the protocol's observation layer may include local processing capability. The adapter receives an HVP-DL configuration specifying the measurement interfaces to activate, the polling intervals, and the analysis methods to apply locally. A basic adapter performs measurement and signed transmission only. An intelligent adapter additionally performs local anomaly pre-screening (for example, Mahalanobis distance computation against the locally cached birth certificate baseline) and transmits only flagged readings to the central analysis layer, reducing network bandwidth in large-scale deployments. An advanced adapter may include machine learning inference capability (such as a neural network trained to detect specific anomaly classes from the local sensor data) operating within the adapter before the data enters the protocol's fusion pipeline. The adapter architecture follows a port-and-adapter pattern where the protocol defines the port interface and domain-specific adapters implement it, enabling third parties to develop certified adapters for new measurement domains without modifying the protocol core. 11 A. Distinction from Existing Attestation Protocols - Identity Versus Honesty Existing attestation systems (IETF RATS, TCG DICE, ARM PSA, Intel Trust Authority) answer the guestion "is this device what it claims to be?" - they verify IDENTITY through cryptographic keys, firmware measurements, and boot chain integrity. The present invention answers a fundamentally different guestion: "is this device behaving honestly?" - it verifies HONESTY through continuous physics measurement of actual behaviour compared against enrolled baselines. A device can be exactly what it claims to be - correct firmware, correct cryptographic keys, correct boot chain, passing all attestation checks - and still be behaving dishonestly because an attacker is using it as a proxy for tunnelled computation, or because the legitimate software is being exploited to perform unauthorised operations, or because a hardware implant is operating below the firmware measurement layer. Identity is necessary but not sufficient for integrity. The present invention detects dishonesty through the physics of behaviour that identity attestation cannot observe. The protocol is distinguished from existing frameworks on four specific axes: Continuous physics monitoring vs point-in-time attestation. IETF RATS (Remote Attestation Procedures, RFC 9334) provides point-in-time attestation where a device produces an evidence bundle on reguest and a verifier evaluates it. The present protocol provides continuous monitoring where physics measurements are collected at configurable intervals (default 100ms for endpoint physics) and compared against enrolled baselines continuously. An attacker who passes a RATS attestation check and then modifies the system is detected by continuous physics monitoring; RATS would not detect the post-attestation modification until the next attestation request. Hierarchical physics birth certificates vs flat cryptographic identity. TCG DICE provides layered firmware identity where each boot layer measures the next layer and derives a certificate. The present protocol provides five-level hierarchical birth certificates where each hardware component has its own physics-grounded certificate (power profile, thermal response, performance counter baseline) composed into device, fleet, and organisation levels via dual Merkle trees. DICE'S hierarchy reflects boot order; the present protocol's hierarchy reflects physical composition. A DICE certificate tells you what firmware loaded; a physics birth certificate tells you what the hardware physically does under controlled conditions. Twelve structured verdict states vs binary pass / fail. RATS produces a binary appraisal result (pass or fail). The present protocol produces twelve verdict states from the combinatorial evaluation of physics evidence, birth certificate comparison, and testimony. Five of these states are structurally impossible for simpler architectures and provide diagnostic resolution unavailable from binary attestation. Corroboration debt vs stateless verification. Neither RATS nor DICE implements a temporal corroboration mechanism where uncorroborated evidence decays and high-severity anomalies require cross-domain physics confirmation to release. This temporal dimension is unique to the present protocol. 12. Causal Evidence Graph Evidence objects produced by the protocol are linked in a directed acyclic graph representing causal relationships between detection events, processing decisions, and enforcement actions. Each evidence object references the evidence objects that causally preceded it, enabling independent verification of the protocol's complete reasoning chain from raw physics measurement through mathematical processing through verdict generation to enforcement execution. 13. Honest Limitations The protocol honestly discloses that MDIEA (Multi-Domain Independent Evidence Architecture) provides robust multi-source aggregation, not Byzantine Fault Tolerance. A nation-state adversary capable of simultaneously compromising multiple observation domains through supply chain attacks, firmware implants, or physical access could defeat the architecture. The protocol is robust against a single compromised domain but provides zero margin beyond that with the default four-domain configuration. The enrollment ceremony is the most dangerous attack surface - a device compromised before or during enrollment produces a malicious birth certificate. The fleet cross-validation mechanism at Layer 1 mitigates but does not eliminate this risk. 14. Alternative Embodiments The observation domains described are exemplary. Any physically independent measurement source producing evidence relevant to the monitored system's integrity may serve as an observation domain within the protocol. The evidence fusion may employ alternative combination rules. The topological analysis may employ alternative computational approaches. The cryptographic algorithms are adapters behind protocol-defined interfaces and may be substituted. In the preferred embodiment, the hierarchical birth certificate is anchored in a Merkle tree using cryptographic hash functions (SHA-256 with domain-separated leaf and node prefixes per RFC 9162), providing resistance to guantum computing attacks on the tree structure because hash-based commitments are not vulnerable to Shor's algorithm. In an alternative embodiment for large-scale deployments exceeding one million monitored devices, the tree structure may use vector commitments (Verkle tree, as described by Kuszmaul 2018) for reduced proof sizes - a Verkle tree produces inclusion proofs of approximately 150 bytes compared to approximately 1 kilobyte for a Merkle tree at eguivalent scale, using polynomial commitments such as KZG (Kate-Zaverucha-Goldberg) to compress inclusion proofs. The trade-off is that vector commitment schemes based on elliptic curve cryptography reguire post-guantum migration, whereas hash-based Merkle trees are inherently guantum-resistant. The five-level hierarchical birth certificate architecture, the twelve verdict states, the corroboration debt mechanism, the capability negotiation handshake, and all other features of the system operate identically regardless of whether the underlying tree structure uses hash-based or vector-based commitments. Features from any embodiment may be combined with features of any other embodiment. The specific numerical values, thresholds, and parameters are exemplary and may be adjusted for specific deployment environments.

Claims

Claim 1 (Independent - Broadest Method)A computer-implemented method for verifying the integrity of a monitored system, the method comprising:(a) during an enrollment phase, collecting, by at least one processor, baseline measurement data from a plurality of physically independent observation domains monitoring the monitored system, and generating a hierarchical birth certificate comprising physics-grounded baselines at a plurality of hierarchical levels, the hierarchical birth certificate being digitally signed and anchored in a Merkle tree structure;(b) during a monitoring phase, collecting current measurement data from the plurality of physically independent observation domains;(c) comparing, by the at least one processor, the current measurement data against the hierarchical birth certificate at each hierarchical level to determine a divergence at each level;(d) fusing evidence from the plurality of physically independent observation domains using a conflict-aware evidence combination rule to generate a combined integrity assessment;(e) generating an integrity verdict selected from a set of verdict states derived from a combinatorial evaluation of at least a physics evidence dimension, a birth certificate comparison dimension, and a testimony dimension; and(f) responsive to the integrity verdict indicating a threat condition, executing an enforcement action constrained by a domain profile associated with the monitored system.Claim 2. The method of claim 1, wherein the set of verdict states comprises twelve states, at least five of which are structurally impossible for systems operating on fewer than three independent evidence domains.Claim 3. The method of claim 1, wherein the hierarchical birth certificate comprises at least three hierarchical levels: a component level capturing physics baselines of individual hardware components, a device composite level cryptographically binding the component-level baselines via Merkle tree composition, and a fleet level representing relationships between multiple monitored systems.Claim 4. The method of claim 1, wherein comparing the current measurement data against the hierarchical birth certificate further comprises: computing a Mahalanobis distance between a current measurement vector and an enrolled baseline mean using the enrolled covariance matrix, and constructing a Basic Belief Assignment over a frame of discernment based on a conformal p-value derived from the Mahalanobis distance.Claim 5. The method of claim 1, further comprising implementing a corroboration debt mechanism wherein a high-severity integrity verdict from a single observation domain accumulates confidence decay over time, and wherein the high-severity verdict cannot be resolved to a clean state by time alone but reguires cross-domain corroboration from at least one additional physically independent observation domain.Claim 6. The method of claim 5, wherein the confidence decay rate is modulated by an aggregate anomaly state across a fleet of monitored systems, such that uncorroborated verdicts decay faster during periods of elevated fleet-wide threat activity.Claim 7. The method of claim 1, further comprising a capability negotiation handshake wherein the monitored system and a verification system exchange supported protocol versions, observation interfaces, analysis methods, fusion rules, and cryptographic algorithms, and wherein the handshake includes anti-downgrade sentinel bytes and a transcript signature.Claim 8. The method of claim 1, wherein the enforcement action is constrained by a domain profile selected from: an enterprise profile permitting full enforcement including irreversible isolation; a medical profile limiting enforcement to alerts only to prevent disruption of patient care; a constrained profile for resource-limited devices permitting alerts and rate-limiting; a sovereign profile for disconnected environments permitting local verdict generation only; and an adversarial profile reguiring external oracle validation in addition to internal observation domains.Claim 9. The method of claim 1, wherein generating the hierarchical birth certificate further comprises: during the enrollment phase, cross-referencing the newly enrolled birth certificate against a fleet distribution of physics baselines for the same hardware model, and flagging the enrollment for human review when the new enrollment's physics profile is statistically anomalous relative to the fleet distribution.Claim 10. The method of claim 1, further comprising a self-healing mechanism for the hierarchical birth certificate, the self-healing mechanism comprising: detecting a change in baseline measurements via cumulative sum detection, classifying the change as one of gradual drift, authorised step change, unauthorised step change, or accelerating drift, and executing a corresponding response of automatic baseline update, streamlined re-enrollment, freeze with investigation, or alert respectively.Claim 11. The method of claim 1, further comprising linking the digitally signed evidence objects in a directed acyclic graph representing causal relationships between detection events, processing decisions, and enforcement actions, enabling independent verification of the protocol's reasoning chain.Claim 12. The method of claim 1, wherein the digital signature uses Ed25519ctx with domain-separated context strings, each signature purpose using a distinct context string and a separate key pair.Claim 13 (Independent - System)An integrity verification system comprising:a plurality of physically independent observation devices, each configured to measure a different physical characteristic of a monitored system using independent hardware with independent cryptographic signing keys;at least one processor communicatively coupled to the plurality of observation devices;a memory storing a hierarchical birth certificate comprising physics-grounded baselines at a plurality of hierarchical levels anchored in a dual Merkle tree structure, the hierarchical birth certificate having been generated during a controlled enrollment ceremony; andinstructions that, when executed by the at least one processor, cause the processor to: receive current measurement data from the plurality of observation devices; compare the current measurement data against the hierarchical birth certificate at each level; fuse evidence from the observation devices using a conflict-aware combination rule with Jousselme distance outlier detection; generate an integrity verdict from a set of twelve verdict states; and execute an enforcement action constrained by a domain profile.Claim 14 (Independent - Computer Program Product)A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the processor to perform a method for verifying integrity of a monitored system, the method comprising:collecting baseline measurement data from a plurality of physically independent observation domains during an enrollment ceremony and generating a hierarchical birth certificate anchored in a Merkle tree structure;during monitoring, comparing current measurement data against the hierarchical birth certificate to determine divergence at each hierarchical level;fusing evidence from the plurality of observation domains using adaptive conflict-aware combination rules;generating an integrity verdict from a set of verdict states including at least five states that are structurally impossible for systems with fewer than three independent evidence domains; andexecuting an enforcement action constrained by a domain profile associated with the monitored system.Claim 15. The method of claim 1, wherein the plurality of physically independent observation domains comprises at least: an endpoint physics domain measuring hardware characteristics of the monitored system, an independent wire observation domain measuring network traffic independently of any software on the monitored system, a software testimony domain collecting self-reported event data, and an identity and configuration domain monitoring enrolled baseline attributes.Claim 16. The method of claim 1, further comprising transmitting a machine-readable measurement configuration message to the monitored system, the configuration message causing the monitored system to physically configure a sensor interface and initiate continuous measurement at parameters specified in the configuration message, wherein the configuration message specifies at least the sensor modality, the polling interval, and the measurement conditions.Claim 17. The method of claim 1, further comprising detecting an inter-domain physics disagreement wherein two or more physics observation domains produce measurements that are mutually inconsistent, applying outlier detection to identify the inconsistent domain, and discounting the inconsistent domain's evidence in the fusion process while flagging the domain for sensor integrity investigation.A

Images