Remote Attestation Using Segmented Hashing for Low-Memory Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Resource-constrained devices face challenges in performing remote attestation due to limited memory and computational resources, which can lead to difficulties in verifying the integrity of system data and detecting malicious alterations.
Innovation Solution
The use of incremental or homomorphic hashing to process segments of system data within a trusted execution environment, generating integrity hashes and a root hash to validate the system's integrity, allowing attestation to be performed efficiently without overwhelming system resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional remote attestation processes are used to verify system data integrity, then security is improved, but memory consumption exceeds available resources and attestation cannot be performed
Solution Approach 1:
The patent divides system data into multiple segments that can be processed individually. Instead of loading all system data into memory at once, the attestation process processes segments sequentially or in manageable batches, allowing integrity verification while keeping memory consumption within available resources.
Solution Approach 2:
The patent transforms the attestation approach from a single-dimension process (processing all data at once) to a multi-dimensional process by introducing time as a dimension through periodic attestation. This allows the system to verify integrity over time without requiring all data to be present simultaneously in memory.
2Reliability
If remote attestation is performed on privileged programs with restricted memory space, then security validation is improved, but the ability to compute hash values is worsened due to data size constraints
Solution Approach 1:
The patent segments the data under attestation into portions that fit within the restricted memory space of privileged programs. Each segment can be hashed independently, and the results are combined to produce the overall attestation result, enabling hash computation despite memory constraints.
Solution Approach 2:
The patent prepares data segments in advance before they are needed for attestation. By pre-processing and organizing data into manageable segments, the system reduces the computational burden during the actual attestation process, making hash computation feasible within restricted memory space.
3Productivity
If parallel remote attestation requests are handled simultaneously, then productivity is improved, but available memory is quickly consumed limiting further parallel requests
Solution Approach 1:
The patent segments parallel attestation requests into smaller sub-tasks that can be processed concurrently with reduced memory footprints. Instead of loading all data for multiple requests simultaneously, each request is broken down into segments that can be handled with limited memory, enabling higher parallel throughput.
Solution Approach 2:
The patent implements periodic processing of attestation requests, where memory is allocated and freed in cycles. This allows the system to handle multiple parallel requests by processing them in periodic batches, releasing memory resources between batches to accommodate new requests.
Data Source
AI summary
Systems, methods, and other embodiments described herein relate to remote attestation for resource-constrained systems. In one embodiment, a method includes acquiring segments of system data within an attesting device responsive to an attestation request. The method includes determining an integrity of the system data by identifying whether a root hash comprised of integrity hashes of the segments matches a reference hash. The method includes providing a report according to the integrity.