Attestation Server Random File Verification for Software Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manufacturers face challenges in preventing unauthorized software execution on computing devices, such as mobile phones, which can compromise the user experience and business models, and in efficiently protecting multiple devices from malicious code infections.
Innovation Solution
An attestation server system that verifies the integrity of software on computing devices by comparing file digests with stored references, restricting functionality if alterations are detected, and uses nonces to prevent replay attacks, ensuring that only authorized software operates on the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software is installed and executed on each computing device, then malicious code detection capability is improved, but computing resource consumption and system complexity increase
Solution Approach 1:
The patent introduces an intermediary attestation server that mediates between computing devices and the trust verification process. Instead of each device independently running antivirus software, the attestation server centrally verifies device integrity by checking file digests against known good values, reducing the complexity and resource burden on individual devices while maintaining security.
2Measurement precision
If file integrity verification is performed on all files, then detection precision is improved, but processing time and computational resources increase
Solution Approach 1:
The patent implements partial verification by selecting and verifying only a subset of files rather than all files on the device. The system can randomly select files for verification or focus on critical system files, achieving sufficient integrity assurance with reduced processing time and computational resources compared to verifying every file.
Solution Approach 2:
The system performs preliminary actions by pre-computing and storing file digests for known good files during device manufacturing or authorized updates. This allows the attestation server to quickly verify file integrity by comparing current file digests against pre-stored reference values, significantly reducing verification time during actual integrity checks.
3Reliability
If comprehensive device monitoring is implemented, then security reliability is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent implements self-service mechanisms where the computing device automatically performs integrity self-assessment by computing file digests and submitting them to the attestation server without requiring user intervention. The device autonomously monitors its own integrity state, reducing operational overhead and maintaining simplicity for end users while achieving comprehensive security monitoring.
Data Source
AI summary
Technologies pertaining to attesting to computer-executable code residing on a robot are described herein. An attestation server includes a database that comprises file paths that correspond to files on the robot at a time of manufacture of the robot. The database also includes file digests that are indicative of content of the files on the robot. The attestation server randomly selects a file path and transmits the file path to the robot. The robot accesses the file at the file path and computes a file digest for that file. The robot then transmits the file digest to the attestation server, which compares the file digest from the robot with the file digest in the database. If the file digests match, then the attestation server attests to the computer-executable code on the robot.