Computation Speed Device Attestation via ASIC Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional device attestation methods rely on private keys and third-party services, which are expensive and insecure, and can be circumvented by software emulators, lacking a solution to verify trusted devices without these dependencies.
Innovation Solution
A method that uses computation-based attestation by sending computation parameters to a communication partner, measuring the time taken for computation, and verifying the result within a threshold to determine if the device has a dedicated computation module, thereby ensuring it is a trusted device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional device attestation uses private keys and third-party services, then device trust verification is achieved, but deployment cost increases and security vulnerabilities are introduced
Solution Approach 1:
The patent extracts the attestation verification function from third-party services and implements it directly within the communication system. The server performs computation speed verification locally without requiring external attestation authorities, eliminating the need for third-party involvement while maintaining trust verification capability
Solution Approach 2:
The system implements self-attestation where devices verify their own trustworthiness through computation speed demonstration. The client device performs computational tasks and the server verifies the results, creating a self-contained attestation mechanism that doesn't require external services
2Reliability
If private keys are used for device attestation, then device identity is verified, but the system becomes vulnerable to key extraction and emulator attacks
Solution Approach 1:
The patent replaces the cryptographic key-based attestation mechanism with a physics-based computation speed verification system. Instead of relying on mathematical hardness assumptions and key secrecy, the system uses the physical property of computation speed to verify device authenticity, making the system resistant to key extraction and software emulation attacks
Solution Approach 2:
The patent changes the attestation parameter from static cryptographic keys to dynamic computation speed measurements. By verifying that computation results are produced within expected timeframes, the system transitions from verifying what a device knows (keys) to verifying what a device can do (compute fast), thereby eliminating key-related security vulnerabilities
3Device complexity
If single shared key attestation is used (e.g., HDCP), then implementation cost is reduced, but security is compromised once the key is extracted
Solution Approach 1:
The patent segments the attestation process into multiple independent computational tasks rather than relying on a single shared key. Each computation challenge-verifies a specific aspect of device functionality, and the server can adjust the difficulty and type of computations dynamically, providing both simplicity and security
4Reliability
If computation speed verification is implemented, then emulator-based attacks are prevented, but additional computation overhead is introduced
Solution Approach 1:
The patent applies partial computation verification where the server requests only enough computational work to verify device authenticity without requiring full-scale computational burden. The computation challenges are designed to be sufficient for verification purposes but not excessively demanding, balancing security with energy efficiency
Data Source
AI summary
The systems, methods and apparatuses described herein provide a computing device that is configured to attest itself to a communication partner. In one aspect, the computing device may comprise a communication port configured to receive an attestation request from the communication partner, and an application-specific integrated circuit (ASIC). The ASIC may be configured to receive the attestation request from the communication port. The attestation request may include a nonce generated at the communication partner. The ASIC may be further generate a verification value and send the verification value to the communication port to be transmitted back to the communication partner. The verification value may be a computation result of a predefined function taking the nonce as an initial value. In another aspect, the communication partner is configured to attest the computing device using speed of computation attestation.