Attestation Certificate Generation for Device Anonymity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users of interconnected computing devices face privacy concerns due to the need for identification when accessing services, which can lead to reduced privacy and user dissatisfaction.
Innovation Solution
A system where a computing device requests an attestation certificate from an attestation service, which verifies the device's hardware and software information, selects a reusable asymmetric key pair, generates an attestation certificate associating the public key with the trusted secure component, and encrypts the private key for secure transmission, allowing multiple devices to share the same key pair for anonymity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user identification information is shared with services for authentication, then secure access to services is enabled, but user privacy is reduced
Solution Approach 1:
The patent introduces an attestation service as an intermediary between the user's computing device and service providers. This mediator verifies the device's identity through hardware-based attestation certificates without exposing personal identification information to service providers, thus maintaining secure authentication while preserving user privacy
Solution Approach 2:
The patent extracts the identification function from personal user data and relocates it to hardware-based device identifiers stored in secure enclaves. By separating identity verification from personal information, the system enables authentication without transmitting or storing sensitive user data at service provider locations
2Adaptability or versatility
If device identification is transmitted to multiple services, then service access is facilitated, but device anonymity is reduced
Solution Approach 1:
The patent implements a key reuse mechanism where a single attestation certificate (copy of device identity) is distributed to multiple service providers. This allows the device to access various services without transmitting its actual identification information to each service, maintaining anonymity while enabling versatile service access
Solution Approach 2:
The attestation certificate serves multiple functions simultaneously: it authenticates the device to different services, enables secure key exchange, and maintains device anonymity. This multi-functional approach allows a single credential to facilitate versatile service access without compromising privacy
Data Source
AI summary
A computing device sends a request for an attestation certificate to an attestation service along with information regarding the hardware and/or software of the device. The attestation service processes the request and verifies the information received from the device. After verifying the information, the attestation service selects a public/private key pair from a collection of reusable public/private key pairs and generates an attestation certificate for the device and public key of the public/private key pair. This attestation certificate is digitally signed by the attestation service and returned to the device. The private key of the selected public/private key pair is also encrypted to a trusted secure component of the device, ensuring that the key cannot be stolen by malware and re-used on another device, and is returned to the device. The device uses this attestation certificate to access relying parties, and optionally generates additional public/private key pairs and attestation certificates.