SASL Message Segmentation for TPM Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Simple Authentication and Security Layer (SASL) framework has limitations in frame size, specifically restricting messages to 512 bytes, which is insufficient for transmitting large public keys or encoded information, hindering the attestation process for IoT devices.
Innovation Solution
Incorporating a control byte into the SASL framework to enable segmented messaging, allowing larger messages to be broken into multiple segments, with the control byte indicating whether a message is an interim or final segment and its sequence number, facilitating the transmission of public keys and challenge keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the SASL framework uses fixed frame size limitation of 512 bytes, then the protocol simplicity is maintained, but the message size capability is insufficient for transmitting large public keys
Solution Approach 1:
The patent divides large messages exceeding 512 bytes into multiple segments, each with a control byte indicating segment number and total count. This allows the SASL framework to transmit large public keys and other data while maintaining the original 512-byte frame structure, resolving the contradiction between message size capability and protocol simplicity.
2Reliability
If the SASL framework transmits large public keys in single messages, then the authentication security is improved, but the frame size limitation prevents successful transmission
Solution Approach 1:
By segmenting large public keys into multiple 512-byte frames with control bytes indicating sequence information, the patent enables transmission of security-critical data that would otherwise exceed frame size limits, maintaining both authentication security and compliance with frame size constraints.
Solution Approach 2:
The patent performs preliminary segmentation of large messages into controlled-size segments before transmission, with each segment tagged with control information. This preliminary preparation ensures that security-critical data can be transmitted in compliance with frame size limitations without compromising integrity.
3Adaptability or versatility
If the SASL framework uses multiple segmented messages, then the message size capability is improved, but the message transmission complexity increases
Solution Approach 1:
The patent segments messages into controlled units with control bytes containing sequence numbers and segment counts, enabling flexible transmission of various sized messages while providing structured handling rules that simplify the complexity of segmented message processing.
Solution Approach 2:
By encoding segment position and total segment count in control bytes, the patent transforms the complex task of segmented message handling into a parameter-driven process where receiving systems can automatically reassemble messages based on numeric parameters, improving ease of operation.
Data Source
AI summary
An existing Simple Authentication and Security Layer (SASL) framework is modified to overcome message size limitations by implementing a control byte that enables segmentation of SASL messages. In implementations in which client computing devices utilize a trusted platform module (TPM) for enhanced security, the client computing device can transmit multiple public keys and other information to a provisioning service during an attestation process. This information can be segmented across multiple messages while leveraging the SASL framework. A control byte may be utilized in each message and define attributes about the respective messages, such as whether a current message is an interim or final message segment. Likewise, the provisioning service can divide a challenge key into multiple segments and include a control byte for each segment. The control byte within segmented messages enables utilization of the TPM public keys and thereby can leverage the heightened security provided by the TPM.