Remote Attestation Frontend for Application Execution Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote attestation methods require complex emulation or access to the application to verify execution integrity, which is impractical due to diverse application versions and instances.
Innovation Solution
A method and system that delegate part of the remote attestation to a Remote Attestation Frontend, generating an application signature from run-time information, independent of the challenge, allowing a Verification Entity to verify execution integrity without needing the application details.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If remote attestation requires complex emulation or access to the application for verification, then verification accuracy is improved, but device complexity and deployment difficulty increase
Solution Approach 1:
The patent extracts the verification logic from the target device and relocates it to the head-end system. The target device only needs to generate attestations using a simple attestation module, while the complex verification process including emulation and integrity checking is performed remotely at the head-end, reducing device complexity while maintaining verification accuracy
Solution Approach 2:
The patent introduces an attestation module as an intermediary component that generates cryptographic attestations without requiring direct access to application memory or complex verification logic. This intermediary enables accurate verification while keeping the target device simple
2Reliability
If remote attestation requires access to application details for verification, then verification reliability is improved, but adaptability to diverse applications decreases
Solution Approach 1:
The patent creates a universal attestation mechanism that works across diverse applications without requiring application-specific verification logic. The attestation module generates standardized cryptographic proofs that can verify integrity of any application, making the system adaptable to different applications while maintaining reliability through cryptographic verification
Solution Approach 2:
The patent uses cryptographic hashing to create a digital copy (hash value) of the application's memory state that can be verified without accessing the actual application details. This copying approach enables verification reliability while maintaining adaptability to diverse applications
Data Source
AI summary
The present invention concerns the field of software verification, in particular to check whether the run-time integrity of a software application can be demonstrated. It is therefore proposed a method to verify, by a verification server, the execution integrity of an application in a target device wherein the verification server receives an application signature generated from run time application information on the target device, said signature being used to verify the execution integrity of the application in the target device, said application comprising an array of blocks, each block producing a digest, thus producing an array of digests related to the array of blocks, comprising the steps of: —sending to the target device a message comprising a challenge and a first function, said first function defining an aggregation method, said challenge defining an aggregation instruction, —receiving an attestation from the target device, this attestation being generated by the target device by determining for each block, the corresponding digest for said block, aggregating the digests of the blocks according to the aggregation method of the first function and the challenge to produce the attestation related to the application, —applying a second function to the attestation by the verification server, said second function undoing the effect of the challenge thus producing an application signature independent of the challenge, —verifying the execution integrity of the application by comparing the produced application signature with a reference signature.