Device Attestation Using Remote Secret Code Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic attestation techniques for electronic devices require significant memory storage, processing power, and communication bandwidth, making them infeasible for small IoT devices, and pose risks of data theft and forgery due to the storage of sensitive information.
Innovation Solution
A method involving the generation of attestation identifiers and secret codes, where different secret codes are provided to different entities, allowing remote storage of assertions and using hash functions to create derivative secret codes that cannot be reversed, thereby mitigating data theft and forgery risks, and optimizing storage and processing requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic techniques store detailed attestation information on the device, then verification capability is improved, but memory storage capacity requirement increases
Solution Approach 1:
The patent extracts the detailed attestation information from the device and stores it remotely on a server. Only essential verification data (attestation identifier and hashed value) remains on the device, while the complete attestation records are stored externally, resolving the contradiction between verification capability and storage capacity requirements
Solution Approach 2:
The patent introduces a server as an intermediary entity that stores and manages detailed attestation information. The server acts as a mediator between the device and the verifying system, allowing comprehensive verification data to be stored centrally without burdening the device's limited storage resources
2Reliability
If cryptographic techniques store detailed attestation information on the device, then verification capability is improved, but processing power requirement increases
Solution Approach 1:
The patent extracts complex cryptographic verification operations from the device and performs them on the server. The device only needs to compute simple hash functions, while the server handles the computationally intensive verification processes, reducing the processing power requirements for IoT devices
3Reliability
If cryptographic techniques store detailed attestation information on the device, then verification capability is improved, but communication bandwidth requirement increases
Solution Approach 1:
The patent extracts only the essential verification elements (attestation identifier and hashed value) from the device to the server during initial provisioning. This minimal data exchange significantly reduces communication bandwidth requirements compared to transmitting or storing complete attestation records on the device
4Reliability
If secret code is stored on the device, then device attestation capability is improved, but security against data theft and forgery worsens
Solution Approach 1:
The patent extracts the secret code from the device and stores it remotely on the server. The device only retains a hashed value of the secret code, which cannot be reversed to obtain the original secret. This extraction eliminates the risk of data theft compromising device security while maintaining attestation capability
Solution Approach 2:
The patent replaces the physical storage of secret codes on the device with a cryptographic hash function. Instead of storing the actual secret code, the device stores a one-way hashed version that cannot be reversed, substituting a secure cryptographic mechanism for direct storage and thereby preventing forgery even if the hashed value is compromised
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for providing an attestation for enabling a device to attest to an assertion concerning the device, comprising: generating an attestation identifier and a base-secret code corresponding to the attestation identifier; providing the attestation identifier and a validation-secret code to a validation apparatus for storage in conjunction with the assertion, wherein the validation-secret code is based on the base-secret code; providing the attestation identifier and a device-secret code to a manufacturer or adapter for provision to a device, wherein the device-secret code is based on the base-secret code.