Remote Message Attestation via Pre-established Certificates

The patent segments the remote attestation process into two independent phases: (1) a setup phase where the remote device interacts with a target device to establish cryptographic bindings between platform configuration register (PCR) values and asymmetric key pairs, and (2) a message signing phase where the remote device can independently sign messages using the established key pairs without requiring real-time connectivity to the target device. This segmentation allows the attestation relationship to be established once and reused across multiple communication scenarios including store-and-forward messaging and delay-tolerant networking.

The patent performs preliminary actions by pre-establishing the cryptographic binding between PCR values and asymmetric key pairs during an initial setup phase before actual message communication occurs. The target device signs the remote device's public key along with relevant PCR values to create a certificate that binds the software configuration state to the cryptographic identity. This preliminary attestation relationship enables subsequent message signing operations to proceed independently without requiring the target device to be immediately available, thus enabling operation in scenarios without immediate end-to-end connectivity.

The patent introduces digital certificates as intermediary objects that mediate the verification process between the remote device and message recipients. The target device acts as a trusted intermediary by signing the remote device's public key together with PCR values to create a certificate. This certificate serves as verifiable evidence that binds the sender's software configuration state to their cryptographic identity. Intermediate nodes in the message routing path can forward messages with these certificates attached, and final recipients can verify the sender's software configuration by checking the certificate signature without needing to interact with the original target device, thus simplifying verification across multiple intermediaries.

The patent creates a verifiable copy of the sender's software configuration state by having the target device sign the PCR values and bind them to the sender's public key in a certificate. This signed certificate is a portable, immutable copy of the attestation evidence that can be attached to messages and forwarded through multiple intermediaries. The certificate serves as a self-contained verification artifact that contains all necessary information (public key, PCR values, signature) for recipients to verify the sender's software configuration without requiring real-time access to the sender's device or the original target device, thus enabling verification in store-and-forward messaging scenarios.

The patent performs the computationally intensive certificate creation operation in advance during an initial setup phase. The target device signs the remote device's public key along with PCR values to create a certificate, which is then stored on the remote device. During subsequent message communication, the remote device simply uses its private key to sign messages, and recipients verify signatures using the pre-established public key and certificate. This eliminates the need to perform complex attestation computations during every message exchange, significantly improving processing efficiency while maintaining strong authenticity and configuration verification guarantees.

The patent segments the cryptographic operations into a heavy setup phase and a lightweight message signing phase. The setup phase involves creating asymmetric key pairs, measuring platform configuration, and generating signed certificates - operations that are computationally intensive but performed only once per communication partner. The message signing phase involves only signing messages with the private key and verifying signatures with the public key - operations that are computationally lightweight and can be performed efficiently for every message. This segmentation allows the system to achieve strong security guarantees while maintaining high message processing throughput.