Delayed Attestation for Computing Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attestation protocols require a network connection to retrieve a manufacturer certificate, leading to delays in accessing secure content and functionality, as the computing device cannot authenticate without this certificate, especially during initial boot sequences or setup processes.
Innovation Solution
Implementing delayed attestation by providing initial credentials generated locally to establish a first level of trust, followed by retrieving security information to generate more trustworthy second credentials, allowing the device to access limited content initially and then upgraded content once the second credentials are available, thus avoiding network-dependent authentication delays.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the computing device waits to retrieve the manufacturer certificate from a certificate authority before authentication, then the authentication reliability is improved, but the authentication time increases causing delays in accessing secure content and functionality
Solution Approach 1:
The patent applies preliminary action by pre-generating first credentials (encryption keys) locally in the security component before network connection is established. This allows the computing device to perform initial authentication immediately without waiting for certificate retrieval, while the more trustworthy second credentials are obtained subsequently through network connection to the certificate authority.
2Speed
If the computing device uses locally generated first credentials for initial authentication, then the authentication speed is improved, but the trust level decreases compared to certificate-based authentication
Solution Approach 1:
The patent segments the authentication process into two distinct stages: first authentication using locally generated encryption keys for immediate access to less secure content, and second authentication using certificate-based credentials for accessing more secure content. This segmentation allows each authentication method to be optimized for its specific purpose without compromise.
Solution Approach 2:
The patent applies local quality by assigning different trust levels and security requirements to different content and functionality. Less secure content can be accessed immediately with first credentials, while more secure content requires the second credentials obtained through proper certificate authentication, matching the security level to the local requirements of each resource.
3Reliability
If the computing device requires network connection for certificate retrieval, then the security protocol completeness is improved, but the device accessibility deteriorates during initial boot or offline scenarios
Solution Approach 1:
The patent performs preliminary generation of encryption keys and first credentials in the security component before any network connection is established. This preliminary action ensures that the device can be accessed and operated immediately upon boot, with the option to later enhance security by retrieving certificates from a certificate authority when network connectivity becomes available.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device, or a security component of a computing device, implements delayed attestation by initially providing first credentials to a remote access device to establish a first level of trust. The first credentials may be provided before or while the computing device or the security component is obtaining security information from a remote security device. The security information is used to generate second credentials that are subsequently provided to the remote access device to establish a second level of trust. The first credentials may comprise an encryption key that can be generated by the security component without having to retrieve information via a network, and the second credentials may comprise an attestation statement that is more trustworthy than the encryption key and that is generated based on a certificate retrieved from a remote security device (e.g., a certificate authority server).