Secure Element and DICE Local Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing systems face security and integrity issues due to compromised layers, with remote attestation methods failing offline and experiencing slow response times, additional compute resource requirements, and network transmission delays.
Innovation Solution
A secure compute environment using a combination of a Secure Element (SE) and Device Identity Composition Engine (DICE), where the SE generates nonces and Layer IDs to validate digital signatures from DICE, ensuring secure access to software layers by storing public keys and validating responses using corresponding public keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If remote attestation servers are used to validate software layers, then security validation capability is improved, but response time deteriorates due to network transmission delays
Solution Approach 1:
The patent extracts the attestation validation functionality from external remote servers and embeds it directly into the device through local components (secure element and DICE). This allows the system to perform security validation locally without requiring network communication with external attestation servers, thereby eliminating network transmission delays while maintaining security validation capability.
2Reliability
If remote attestation servers are deployed, then security validation is improved, but device complexity increases due to additional compute resources
Solution Approach 1:
The patent removes the dependency on external remote attestation servers and extracts only the essential validation logic into lightweight local components. The secure element and DICE together provide a minimal, efficient validation mechanism that eliminates the need for additional remote compute resources while maintaining security validation capability.
3Reliability
If offline operation is not supported, then security validation accuracy is improved, but system adaptability deteriorates
Solution Approach 1:
The patent implements a self-service validation mechanism where the device validates its own software layers locally using the secure element and DICE. This self-contained approach eliminates dependency on external servers for validation, enabling accurate security validation to occur offline while maintaining system adaptability to various operational environments.
4Reliability
If network-based attestation is used, then security validation capability is improved, but loss of substance increases due to network transmission requirements
Solution Approach 1:
The patent extracts the validation process from network-based operations and implements it locally. By performing security validation through local interactions between the secure element and DICE components, the system eliminates the need for network transmission of validation data, thereby preventing loss of network resources while maintaining security validation capability.
Data Source
AI summary
In some aspects, the techniques described herein relate to a system including: a Device Identity Composition Engine (DICE) configured to generate asymmetric key pairs for software layers of a computing system; and a secure element (SE), the secure element configured to receive requests for accessing the software layers and validating a request for a given software layer by: generating a nonce, providing the nonce and an identifier of the given software layer to the DICE, receiving a response from the DICE, and validating the response using a public key corresponding to the given software layer to allow access to the given software layer.