Remote Attestation via Trusted Storage Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote attestation technologies face challenges in verifying the integrity and security of applications running in trusted execution environments, particularly due to circular dependency issues and the inability to handle updates or new applications effectively.
Innovation Solution
A remote attestation method that utilizes a trusted storage module to store attestation evidence, allowing applications to upload and store reference values independently, thereby avoiding circular dependency and enabling seamless updates or additions of new applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications store attestation evidence locally to enable remote attestation, then remote attestation can be performed, but circular dependency issues arise when applications need to verify each other
Solution Approach 1:
A cloud server acts as an intermediary to store and manage attestation evidence for multiple applications. Instead of applications storing evidence locally which causes circular dependency, the cloud server centralizes the evidence storage, allowing any application to retrieve needed evidence without creating verification loops.
Solution Approach 2:
The system transitions from local storage (two-dimensional: application A stores evidence for B, application B stores evidence for A) to cloud-based storage (three-dimensional: cloud server stores evidence for all applications). This dimensional change resolves the circular dependency by introducing a central authority that manages all attestation evidence.
2Reliability
If applications include reference values in their code to enable verification, then attestation can be performed, but updates or new applications cannot be handled effectively
Solution Approach 1:
Applications upload their attestation evidence to the cloud server in advance before needing verification. This preliminary action allows the system to handle updates and new applications flexibly, as the cloud server already stores the necessary evidence or can retrieve it when needed, without requiring changes to application code.
Solution Approach 2:
The cloud server provides universal access to attestation evidence for all applications, both existing and new. Instead of each application having its own reference values embedded in code, the cloud server serves as a universal repository that any application can query, enabling seamless handling of updates and new applications.
3Reliability
If applications perform mutual verification to ensure security, then trust between applications is established, but the verification process becomes complex and time-consuming
Solution Approach 1:
The cloud server provides feedback mechanisms where applications can retrieve attestation evidence and verification results efficiently. The server manages the verification process and returns results, reducing the time applications would otherwise spend on mutual verification while maintaining trust through centralized coordination.
Data Source
AI summary
The disclosure provides a remote attestation method, apparatus, electronic device, and storage medium. The method is applied to a first application, and the first application runs in a first trusted execution environment. The method includes: initiating a remote attestation request to a second application, wherein the second application runs in a second trusted execution environment; obtaining a first attestation response returned by the second application; obtaining a first attestation evidence of the second application from a target trusted storage module, wherein the first attestation evidence is uploaded and stored in the target trusted storage module by the second application; and performing remote attestation based on the first attestation response and the first attestation evidence, to obtain a first remote attestation result for the second application.