Client Device Attestation Tokens for Request Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Client devices face issues with data integrity and security as their communications can be altered or intercepted, and are vulnerable to malicious attacks and emulations, leading to fraudulent requests and compromised trustworthiness.
Innovation Solution
The use of attestation tokens, including a public key, token creation time, and device integrity tokens, digitally signed by the client device and a third-party system, to verify the integrity of client device communications, ensuring the authenticity and trustworthiness of requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If client devices transmit requests over public networks, then communication accessibility is improved, but data integrity and security deteriorate due to interception and alteration by third parties
Solution Approach 1:
The patent introduces an attestation token as an intermediary mechanism between the client device and the server. This token contains cryptographic data (public key, digital signature, device identifier) that mediates the trust relationship, allowing the server to verify the client's identity and data integrity without direct cryptographic communication over the public network, thus resolving the contradiction between network accessibility and data security
2Reliability
If digital signatures and attestation tokens are implemented, then data integrity and authentication are improved, but system complexity increases due to additional verification steps
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing the client device's public key and device identifier in the attestation token before the actual authentication occurs. The server verifies these pre-computed cryptographic elements during the authentication process, which simplifies the verification steps compared to performing complex cryptographic operations at runtime, thus reducing the apparent complexity while maintaining strong authentication
3Reliability
If attestation tokens with timestamps are used, then request freshness and replay attack prevention are improved, but processing time increases due to time validation checks
Solution Approach 1:
The patent applies partial action by implementing time validation with a reasonable threshold rather than checking for exact timestamp matches or using excessively long validation periods. The system checks whether the token creation time falls within an acceptable window (e.g., recent past), which provides sufficient replay attack prevention while minimizing processing time overhead, thus resolving the contradiction between security and performance
Data Source
AI summary
Methods, systems, and apparatus, including an apparatus for verifying the integrity of requests and the devices that sent the requests. In some aspects, a method includes receiving, from a client device, a request including an attestation token generated by the client device. The attestation token includes a set of data that includes at least a public key of the client device, a token creation, and a device integrity token that includes a verdict. The attestation token also includes a digital signature of the set of data generated using a private key corresponding to the public key. The integrity of the request is verified using the attestation token by determining that the token creation time being within a threshold duration of the time at which the request was received, the set of data was not modified since the attestation token was created, and the verdict indicates the client device is trustworthy.