Attestation Evidence Format Negotiation for Verifier Interoperability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attestation systems face challenges in interoperability due to the support of different proprietary and standard attestation evidence data formats, leading to scalability issues and complexity in attestation verifiers, especially in cloud and distributed environments, and the use of baseboard management controllers can invalidate third-party policies.
Innovation Solution
A negotiation protocol is implemented to find overlapping data formats between attestation environments and verifiers, allowing the attestation environment to re-format or re-sign attestation evidence to match the agreed-upon format, ensuring compatibility and preserving critical trusted signing keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If different proprietary and standard attestation evidence data formats are supported, then interoperability is improved, but device complexity and scalability issues arise
Solution Approach 1:
The patent introduces a format conversion intermediary layer that translates between different attestation evidence data formats. The attestation verifier uses a standard internal format, and conversion modules act as intermediaries to translate incoming evidence from various proprietary formats into the standard format, thereby maintaining interoperability without increasing core verifier complexity.
Solution Approach 2:
The patent segments the attestation verification system into modular components: a core verifier that handles standard formats and optional conversion modules for specific proprietary formats. This segmentation allows the system to support multiple formats by selectively loading only the necessary conversion modules, reducing overall complexity while maintaining versatility.
2Ease of operation
If baseboard management controllers are used for attestation, then ease of operation is improved, but third-party policies are invalidated
Solution Approach 1:
The patent extracts the attestation evidence generation function from the baseboard management controller and relocates it to a dedicated attestation environment running on the confidential computing platform. This extraction preserves ease of operation by maintaining automated attestation while ensuring that third-party policies remain valid since the attestation now originates from a trusted confidential computing environment rather than the BMC.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to obtain a first set of data formats. The first set of data formats comprises data formats that are available to an attestation environment of a confidential computing environment for generation of attestation evidence of a confidential computing environment. The machine-readable instructions further comprise instructions to obtain a second set of data formats. The second set of data formats comprises data formats of attestation evidence that are available to an attestation verifier. The machine-readable instructions further comprise instructions to determine an optimal data format for attestation evidence of a confidential computing environment based on the first set of data formats and the second set of data formats and to generate attestation evidence of the confidential computing environment in the determined optimal data format.