Secure Enclave Attestation for Tamper-Resistant Application Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face challenges in verifying the integrity of applications to ensure they have not been modified by bad actors, which can compromise their intended functionality or data integrity.
Innovation Solution
A computing device employs a secure enclave processor (SEP) to generate attestations for applications, using cryptographic keys and metadata verification to ensure the application's integrity, which can be signed and verified by a remote server or the operating system, ensuring the application has not been tampered with.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If application code is allowed to be modified to add functionality or remove restrictions, then adaptability and versatility improve, but reliability deteriorates because the application may no longer operate as intended by the developer
Solution Approach 1:
The system separates the application code from the verification mechanism by using a secure enclave processor that independently verifies application integrity. The application can be modified in the main processor while the secure enclave maintains a separate verification process using cryptographic hashes to detect modifications.
Solution Approach 2:
A secure enclave processor acts as an intermediary between the application and the verification system. It receives the application code, verifies its integrity using cryptographic methods, and provides authentication without requiring direct trust between the application and the verifying entity.
2Reliability
If cryptographic verification mechanisms are implemented to ensure application integrity, then reliability improves, but device complexity increases due to additional secure processing requirements
Solution Approach 1:
The secure enclave processor is nested within the computing device architecture, providing security functions without requiring a completely separate verification system. The enclave can be integrated into the device's existing processor structure while maintaining cryptographic isolation for verification operations.
3Ease of operation
If application modifications are permitted to circumvent restrictions, then ease of operation improves for users, but object-generated harmful factors increase as bad actors can falsify data to obtain rewards
Solution Approach 1:
The system performs preliminary verification of application integrity before allowing the application to execute or access restricted functions. The secure enclave processor verifies the application's cryptographic hash against the expected value, preventing modified applications from running and thus preventing data falsification before it can occur.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
Techniques are disclosed relating to application verification. In various embodiments, a computing device includes a secure circuit configured to maintain a plurality of cryptographic keys of the computing device. In such an embodiment, the computing device receives, from an application, a request for an attestation usable to confirm an integrity of the application, instructs the secure circuit to use one of the plurality of cryptographic keys to supply the attestation for the application, and provides the attestation to a remote computing system in communication with the application. In some embodiments, the secure circuit is configured to verify received metadata pertaining to the identity of the application and use the cryptographic key to generate the attestation indicative of the identity of the application.