Remote Attestation Verifier for Software Modification Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote attestation schemes fail to distinguish between software modifications caused by cyberattacks and those resulting from failures such as noise or malfunctions in the prover device, complicating integrity verification.
Innovation Solution
A verifier device that collects evidence data from a prover device, compares it with master software, and determines the cause of software modifications by extracting differences, utilizing a difference extraction unit and cause determination unit to identify whether the modification is due to a cyberattack or a failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If remote attestation verifies software integrity by comparing measurement results, then software integrity can be confirmed, but the system cannot distinguish between modifications caused by cyberattacks and those caused by device failures
Solution Approach 1:
The verification process is segmented into multiple independent components: measurement result verification, evidence data collection, difference extraction, and cause determination. Each component handles a specific aspect of the verification process, allowing the system to separately identify both the presence of modifications and their underlying causes without conflating these distinct functions.
Solution Approach 2:
Evidence data serves as an intermediary between the measurement result and the cause determination. The verifier device collects evidence data from the prover device, extracts differences from this evidence, and uses the extracted differences to determine whether modifications resulted from cyberattacks or device failures. This intermediary enables the system to preserve cause identification capability while maintaining integrity verification.
2Productivity
If the verifier only checks measurement results, then verification is simple and fast, but it cannot determine the specific cause of software modifications
Solution Approach 1:
The prover device prepares evidence data in advance before the verification process begins. This evidence data includes information about the software environment and execution context that would otherwise need to be collected during verification. By performing this preparation beforehand, the system maintains fast verification speed while ensuring precise cause determination is possible when modifications are detected.
Solution Approach 2:
The system implements a feedback mechanism where the verifier device sends evidence collection requests to the prover device based on detected modifications. The prover device responds by providing relevant evidence data, which the verifier then analyzes to determine the cause. This feedback loop enables precise cause determination while maintaining efficient verification through on-demand evidence collection rather than continuous monitoring.
Data Source
AI summary
A verifier device in a remote attestation system including a prover device and a verifier device is provided. The verifier device includes: an evidence data reception unit configured to receive evidence data, which is software, from a prover device that places and executes the software in a memory; a master storage unit configured to store master software, which is a copy of the software; a difference extraction unit configured to extract a difference between the evidence data received and the master software; a cause determination unit configured to determine a cause of modification of the software based on the difference; and a cause information output unit configured to output cause information indicating the cause determined.