Root of Trust Chain for Node Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems face challenges in establishing and maintaining a reliable chain of trust, particularly in ensuring the integrity and authenticity of software and firmware components across multiple nodes in a computing system, which is crucial for preventing malicious code infiltration and maintaining system security.
Innovation Solution
A system and method utilizing a Root of Trust (RoT) that executes a root trusted server to establish and maintain a chain of trust by authenticating and monitoring code execution across nodes, ensuring only trusted operations are executed and that authenticated code and static data remain unchanged, thereby preventing malicious code from infiltrating the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a Root of Trust is deployed at every node to ensure security, then system security is improved, but device complexity and cost increase
Solution Approach 1:
The patent segments the chain of trust into hierarchical levels: a single Root of Trust at the top level that authenticates initial boot code, and multiple subordinate trusted servers at lower levels that authenticate subsequent code. This segmentation allows one RoT to secure multiple nodes through the chain of trust, reducing the total number of RoTs needed while maintaining security.
Solution Approach 2:
The patent implements nested trust relationships where trusted servers run within nodes and can authenticate other nodes, creating a nested chain of trust structure. The RoT nests the first trusted server, which in turn nests second trusted servers, and so on. This nesting allows a single RoT to indirectly secure multiple nodes through the hierarchical trust chain.
2Reliability
If multiple RoTs are deployed across nodes, then security coverage is improved, but system cost and complexity increase
Solution Approach 1:
The patent makes the initial trusted server multi-functional by enabling it to both run as a trusted client (consuming trust from the RoT) and act as a trusted server (providing trust to other nodes). This universality allows a single trusted server instance to extend the RoT's security coverage to multiple nodes without requiring additional RoTs.
3Reliability
If strict code authentication is enforced at each node, then integrity is improved, but processing time and operational complexity increase
Solution Approach 1:
The patent performs code authentication in advance during the boot process and code loading phases, before execution. The RoT authenticates the initial trusted server code during boot, and trusted servers authenticate subsequent code before transferring control. This preliminary authentication ensures integrity without adding complexity to the operational execution phase.
Solution Approach 2:
The patent introduces trusted servers as intermediaries between the RoT and application code. Instead of the RoT directly authenticating all code across all nodes, the trusted servers mediate the authentication process, simplifying the operational complexity while maintaining strict integrity checks through the chain of trust.
Data Source
AI summary
A system for establishing and maintaining a chain of trust can include a root of trust (RoT) executing a root trusted server that pushes authenticated code and data into memory of a given node in a plurality of nodes. The RoT can also record a memory address range of a static portion of the authenticated code and a corresponding static data in the given node and cause the given node to execute the authenticated code in response to the pushing to establish a trusted relationship between the trusted server of the RoT and the given node. The root trusted server also monitors the given node to ensure that the given node executes trusted operations. The authenticated code in the memory of the given node can include a trusted server that pushes authenticated code into memory of another node in the plurality of nodes.