Secure Platform Voucher Service for Software Component Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Software components are vulnerable to complex attacks by malware, such as man-in-the-middle, rootkit, and spyware, which can compromise their integrity and authenticity, making it difficult for remote entities to ensure they are provisioning the correct, unmodified versions.

Innovation Solution

A secure platform voucher service is implemented within an execution environment, using intra-partitioning and cryptographic verification to protect software components by isolating and authenticating them, ensuring only authorized access and preventing unauthorized modifications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If software components are deployed in execution environments, then system functionality is improved, but vulnerability to malware attacks increases

Engineering Contradiction:

Improvesystem functionalityVSAvoidmalware attacks

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The execution environment is divided into isolated partitions, each containing specific software components. This segmentation limits the spread of malware within the system by creating boundaries that prevent unauthorized access between partitions, thus maintaining system functionality while reducing vulnerability to malware attacks.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A secure platform voucher service acts as an intermediary between remote entities and software components. This service provides verification proofs that authenticate the integrity and authenticity of components, enabling secure provisioning without direct exposure of components to potential malware attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If remote entities provision software components, then system capability is enhanced, but assurance of unmodified version decreases

Engineering Contradiction:

Improvesystem capabilityVSAvoidassurance of unmodified version

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The secure platform voucher service performs preliminary verification of software component integrity before provisioning. By verifying cryptographic signatures and checking against trusted platforms in advance, the system ensures that only unmodified, authentic versions are deployed, maintaining reliability while enhancing system capability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements a feedback mechanism where the secure platform voucher service provides verification proofs to remote entities. This feedback loop continuously monitors and confirms the integrity of provisioned components, ensuring that the correct unmodified versions are installed and maintaining trust in the provisioning process.

Inventive Principle:

Principle #23Feedback

3Object-affected harmful factors

If software components are isolated for security, then protection against malware improves, but access control complexity increases

Engineering Contradiction:

Improveprotection against malwareVSAvoidaccess control complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The secure platform voucher service provides a universal interface for access control that handles multiple security functions through a single mechanism. By using cryptographic verification proofs that can be validated by any remote entity, the system simplifies access control complexity while maintaining strong protection against malware through unified security protocols.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS8132003B2Secure platform voucher service for software components within an execution environment

Publication Date: 2012.03.06 INTEL CORP

AI summary

Embodiments of apparatus, articles, methods, and systems for secure platform voucher service for software components within an execution environment are generally described herein. An embodiment includes the ability for a Virtual Machine Monitor, Operating System Monitor, or other underlying platform capability to restrict memory regions for access only by specifically authenticated, authorized and verified software components, even when part of an otherwise compromised operating system environment. A provisioning remote entity or gateway only needs to know a platform's public key or certificate hierarchy in order to receive verification proof for any component in the platform. The verification proof or voucher helps to assure to the remote entity that no man-in-the-middle, rootkit, spyware or other malware running in the platform or on the network will have access to the provisioned material. The underlying platform to lock and unlock secrets on behalf of the authenticated/authorized/verified software component provided in protected memory regions only accessible to the authenticated/authorized/verified software component. Other embodiments may be described and claimed.