Combined Hardware and Software Device Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device attestation methods do not adequately account for the dynamic nature of IoT devices, which are increasingly defined by their software configurations and installed applications, rather than just their hardware identities.
Innovation Solution
A method for creating a comprehensive attestation of a device that includes both hardware and software specifications, where the hardware specification is based on the device's hardware identity and the software specification details the installed applications, allowing for a unique and dynamic identification of the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If device authentication uses only hardware identity, then device identification is simple and stable, but it cannot reflect the dynamic software configuration that defines IoT device functionality
Solution Approach 1:
The attestation is segmented into distinct components: hardware attestation (device identity) and software attestation (application specification). This segmentation allows the system to maintain simple hardware identification while adding software configuration information as a separate, optional layer that reflects the dynamic nature of IoT devices.
Solution Approach 2:
The software attestation is nested within the overall device attestation structure. The application program specification is contained within the device attestation data, allowing the software configuration information to be embedded alongside hardware identity information in a hierarchical manner.
2Reliability
If device attestation includes both hardware and software specifications, then device authentication becomes more meaningful and robust, but the attestation creation process becomes more complex
Solution Approach 1:
The system performs preliminary actions by generating hardware attestation data first, then building the software attestation layer on top of it. The application program specification is created by recording installed applications and generating their specification, which is then integrated with the pre-existing hardware attestation.
Solution Approach 2:
The device controller acts as an intermediary that coordinates between the hardware identification system and the software specification system. It manages the attestation creation process by collecting hardware identity information, recording application programs, and assembling the complete device attestation that combines both hardware and software specifications.
3Reliability
If only hardware identity is used for device identification, then privacy is protected by keeping device unknown, but the device cannot be uniquely identified for authentication purposes
Solution Approach 1:
The attestation system applies local quality by providing different levels of information disclosure for different purposes. The hardware attestation provides stable device identification, while the software attestation provides application-specific information. This allows the system to disclose only the necessary information for authentication while maintaining privacy for other aspects.
Data Source
Figure 1~2
AI summary
The invention relates to a method for creating an attestation (15) of a device (1), comprising the steps of: - storing a hardware specification of the device (1) in a hardware attestation, wherein the hardware specification is based on a hardware identity of the device (1), - detecting the application programs (12) installed on the device (1), - creating an application program specification based on the detected installed application programs (12), - storing the application program specification in a software attestation, and - creating the attestation (15) of the device (1) by: o storing the hardware attestation in the attestation (15), and o storing the software attestation or a reference to the software attestation in the attestation (15). The invention also relates to an associated computer program product and a higher-level device and a higher-level system.