Application Certificate Enrollment in Device Chain of Trust
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices, especially in IoT scenarios, face challenges in securely verifying the presence and properties of installed applications, as existing methods may allow malicious applications to be installed, compromising security and trust in interactions with service providers.
Innovation Solution
A method where a specified application on a computing device is enrolled into a chain of trust within a public key infrastructure (PKI), generating an application certificate that is a descendant of the device certificate, allowing secure verification of the application's presence and properties without exposing private keys, and enabling attestation of events and version updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic techniques are used to provide root of trust with embedded keys, then device trust and security verification are improved, but device complexity and key management overhead increase
Solution Approach 1:
The patent segments the trust verification process by separating device-level certificates from application-level certificates. The device certificate verifies the hardware/root of trust, while application certificates verify specific software components. This segmentation allows targeted verification without requiring complex management of a single comprehensive key system.
Solution Approach 2:
The patent introduces a hierarchical dimension to certificate management, organizing certificates in a tree structure with device certificates at the root and application certificates as descendants. This dimensional organization simplifies key management by establishing clear parent-child relationships where parent certificates attest to the validity of child certificates, reducing the complexity of verifying trust chains.
2Measurement precision
If application certificates are generated and enrolled in PKI chain, then verification of application presence and properties is improved, but processing overhead and enrollment complexity increase
Solution Approach 1:
The patent implements preliminary action by having application certificates pre-generated and pre-enrolled in the PKI chain during device setup or application installation. The certificates are created before verification is needed, with the device certificate already attesting to their validity. This eliminates the need for complex real-time verification processes and reduces enrollment complexity during critical verification moments.
3Reliability
If remote validation is implemented to verify application installation, then security verification is improved, but network dependency and validation time increase
Solution Approach 1:
The patent implements self-service by enabling devices to perform local verification of application certificates using the enrolled PKI chain. The device can independently validate application presence and properties by checking the certificate hierarchy against its stored device certificate, without requiring continuous remote server validation. This reduces network dependency and accelerates verification processes while maintaining security reliability.
Data Source
AI summary
A method for a device comprises enrolling a specified application installed on the device into a chain of trust provided by a private key infrastructure. In the chain of trust, a child certificate is attested as valid by an attestor associated with a parent certificate in the chain of trust. Enrolling includes generating an application certificate 20-A for verifying that the specified application is installed on the device 2. The application certificate is a descendant certificate of the device certificate associated with the device and the chain of trust.