Aggregated Signature Attestation for Trusted Computing Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In trusted computing environments, the overhead for verifier attestation operations is high due to individual security verifications of multiple devices, which can be resource-intensive and inefficient.
Innovation Solution
A method where a verifier selects target devices and generates an aggregated signature by combining individual signatures in a specific order, reducing the need for individual verifications by using a single aggregated signature for attestation across multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the verifier performs individual security attestations for all devices in the platform, then the reliability of each device is verified, but the attestation overhead of the verifier increases
Solution Approach 1:
The patent combines multiple individual device signatures into a single aggregated signature that represents all target devices. The verifier receives one aggregated signature instead of multiple individual signatures, reducing verification overhead while maintaining security. The aggregation process merges signature data from multiple devices (first device, second device, etc.) into a unified cryptographic proof that the verifier can validate in a single operation.
2Reliability
If the verifier performs individual security attestations for all devices in the platform, then comprehensive security coverage is achieved, but the computational load increases
Solution Approach 1:
The patent merges multiple cryptographic verification operations into a single aggregated signature verification. Instead of performing separate computational intensive verification operations for each device, the system combines the signature data from multiple devices into one aggregated signature that can be verified in a single computational pass, significantly reducing the verifier's computational load while maintaining comprehensive security coverage.
Solution Approach 2:
The patent segments the attestation process into two distinct phases: (1) signature aggregation phase where multiple device signatures are combined into a single aggregated signature by the master controller, and (2) verification phase where the verifier performs a single verification operation on the aggregated signature. This segmentation separates the computationally intensive aggregation work from the verification work, optimizing the overall system performance.
3Loss of information
If individual signatures are verified for each device, then detailed security information is obtained, but the communication overhead increases
Solution Approach 1:
The patent combines multiple individual signature data transmissions into a single aggregated signature transmission. Instead of the verifier receiving and processing multiple separate signature messages from multiple devices, the master controller aggregates these signatures into one consolidated signature message, reducing communication overhead and data transmission volume while preserving all necessary security verification information.
Data Source
AI summary
A computing device in a trusted computing (TC) system and an attestation method thereof are provided. The computing device includes at least one processor configured to operate as instructed by program code, the program code including: transmission code configured to cause the at least one processor to transmit, to a master controller, a first identification (ID) for a first device selected among a plurality of devices included in the TC system, a second ID for a second device selected among the plurality of devices, and a nonce; and attestation code configured to cause the at least one processor to perform attestation for the first device and the second device based on an aggregated signature, wherein the aggregated signature is based on generation of a first signature, by the first device, by using the nonce, and generation of a second signature, by the second device, by using the first signature.