Device Attestation Server for Mobile Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively track and enforce security policies for compromised mobile devices, allowing unauthorized access to sensitive data and services due to the lack of consideration for device integrity during access control.
Innovation Solution
A device attestation server and method that provides a universal attestation value to validate the integrity of mobile devices, allowing authorized entities to enforce access controls by embedding attestation status in access tokens and using various attestation methods based on agency policies, ensuring only secure devices access sensitive services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access control is granted based only on access token validity, then ease of operation is improved, but security is worsened because compromised devices can access sensitive services
Solution Approach 1:
The system performs device integrity verification (attestation) before granting access to sensitive services. The attestation client on the mobile device evaluates integrity indicators and generates an attestation result that is verified by the server before allowing service access, preventing compromised devices from gaining unauthorized access
Solution Approach 2:
An attestation server acts as an intermediary between the mobile device and the service provider. The server receives attestation requests, validates the device's integrity status, and returns verification results that determine whether access should be granted, separating the authentication process from the access control decision
2Reliability
If device integrity verification is implemented, then security is improved, but device complexity is worsened due to additional attestation components
Solution Approach 1:
The attestation server provides a universal verification service that can be used by multiple service providers and applications. The same attestation infrastructure serves different security requirements across various services, reducing the need for separate verification systems and minimizing overall system complexity
Solution Approach 2:
The mobile device performs self-evaluation of its integrity status through the attestation client, which automatically assesses integrity indicators and generates the attestation result without requiring manual intervention or complex external verification processes
3Reliability
If real-time tracking of compromised device status is implemented, then security response is improved, but loss of time is worsened due to additional verification steps
Solution Approach 1:
The device continuously evaluates integrity indicators and maintains an up-to-date attestation result before service requests. This preliminary evaluation ensures that when access is requested, the verification can be completed quickly using pre-computed integrity data, reducing access time while maintaining real-time security tracking
Solution Approach 2:
The system implements continuous monitoring of device integrity indicators with feedback loops that update the attestation status in real-time. When integrity changes are detected, the system immediately updates the device status and notifies relevant services, enabling rapid security responses without requiring continuous active verification
Data Source
AI summary
A device attestation server and method for attesting to the integrity of a mobile device is provided. An attestation request is sent from a mobile device to a device attestation server. The device attestation server runs an attestation method that is supported by the mobile device. The device attestation server creates an attestation token that includes a validation result and a plurality of attributes. The device attestation server sends the attestation token to the mobile device, which performs a validation method using the attestation token.