Client Request Attestation Tokens for Device Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Client devices face issues with data integrity and trustworthiness due to interception, alteration, and malicious attacks, leading to fraudulent requests and unauthorized access, which existing authentication methods fail to adequately address.
Innovation Solution
The use of attestation tokens, including a public key, token creation time, and device integrity tokens, digitally signed by the client device and a third-party system, to verify the integrity and trustworthiness of client device communications, ensuring secure communication channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If client devices transmit requests over public networks, then communication accessibility is improved, but data integrity and trustworthiness deteriorate due to interception and alteration
Solution Approach 1:
The system performs preliminary actions by generating attestation tokens before requests are transmitted. These tokens include device integrity information, public keys, and timestamps that are prepared in advance to verify the authenticity and integrity of subsequent requests, preventing interception and alteration issues
Solution Approach 2:
The patent introduces an intermediary verification mechanism using attestation tokens that mediate between client devices and servers. The tokens serve as third-party credentials that prove device integrity and request authenticity without requiring direct trust between communicating parties, thus maintaining reliability over public networks
2Ease of operation
If existing authentication methods are used, then ease of operation is maintained, but protection against fraudulent requests and malicious attacks is insufficient
Solution Approach 1:
The attestation token structure employs a nested doll principle by embedding multiple layers of verification information within a single token. The token contains device integrity tokens, public keys, timestamps, and request signatures nested together, allowing comprehensive verification in one step rather than multiple separate authentication processes
Solution Approach 2:
The system changes authentication parameters by transitioning from simple credential verification to multi-parameter verification including device integrity metrics, cryptographic signatures, temporal validation, and request-specific authentication. This parameter expansion maintains ease of operation while significantly improving fraud protection
3Reliability
If device integrity verification is implemented, then trustworthiness of client devices is improved, but device complexity increases due to additional verification mechanisms
Solution Approach 1:
The verification system implements self-service by having client devices generate their own attestation tokens using their inherent device characteristics and cryptographic key pairs. The device integrity information is derived from the device itself rather than requiring external verification infrastructure, reducing overall system complexity while maintaining high trustworthiness
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including an apparatus for verifying the integrity of requests and the devices that sent the requests. In some aspects, a method includes receiving, from a client device, a request including an attestation token generated by the client device. The attestation token includes a set of data that includes at least a public key of the client device, a token creation, and a device integrity token that includes a verdict. The attestation token also includes a digital signature of the set of data generated using a private key corresponding to the public key. The integrity of the request is verified using the attestation token by determining that the token creation time being within a threshold duration of the time at which the request was received, the set of data was not modified since the attestation token was created, and the verdict indicates the client device is trustworthy.