Self-regulating Attestation Client Health Credential

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current attestation systems lack the ability to verify the self-regulation and future health of computing systems, leading to unbounded resource utilization and inefficiencies due to unbounded attestation logs and reliance on remote services for continuous validation.

Innovation Solution

A self-regulating attestation client that requests a credential of health from an attestation service, providing an ordered and tamper-resistant log with proof of integrity and freshness, and uses this credential to authenticate its current health, reducing the need for continuous remote validation and bounding the attestation log size.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the attestation client continuously sends the entire attestation log to the attestation service for validation, then the reliability of health verification is improved, but the resource utilization and time consumption increase due to unbounded log growth and continuous remote validation

Engineering Contradiction:

Improvehealth verification reliabilityVSAvoidvalidation time consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The attestation service performs preliminary validation of the attestation log and issues a credential of health that contains pre-validated trust information. This credential can be used for multiple authentication requests within its validity period, eliminating the need for continuous remote validation and reducing time consumption while maintaining reliability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The attestation system segments the validation process into two parts: (1) comprehensive log validation by the attestation service to generate the credential of health, and (2) use of the credential for multiple authentication requests without repeated full validation. This segmentation reduces redundant validation operations and time consumption.

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If the attestation log continuously records all system events, then the measurement precision of system health is improved, but the resource utilization increases due to unbounded log size

Engineering Contradiction:

Improvesystem health measurement precisionVSAvoidattestation log size

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The attestation service performs preliminary validation of the entire attestation log including integrity verification and security policy checks before issuing the credential of health. This preliminary action captures all necessary health information in advance, allowing the client to use the credential without continuously storing and transmitting the full log, thus bounding the log size while maintaining measurement precision.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If the attestation service validates every authentication request by examining the full attestation log, then the reliability of authentication is improved, but the productivity and resource efficiency deteriorate

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidauthentication processing efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The attestation service performs comprehensive authentication validation in advance by validating the attestation log and issuing a credential of health. During the credential's validity period, authentication requests are processed efficiently using the pre-validated credential without repeated full log examination, improving productivity while maintaining authentication reliability through the trusted credential mechanism.

Inventive Principle:

Principle #10Preliminary action

4Reliability

If the system relies on continuous remote attestation services for validation, then the reliability of trust verification is improved, but the device complexity and operational overhead increase

Engineering Contradiction:

Improvetrust verification reliabilityVSAvoidattestation system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The attestation client uses the credential of health to perform self-attestation and self-validation during authentication requests within the credential's validity period. This self-service capability reduces reliance on continuous remote attestation services, simplifying the system operational overhead while maintaining trust verification reliability through the pre-issued credential that encapsulates validated trust information.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS8880667B2Self regulation of the subject of attestation

Publication Date: 2014.11.04 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Attestation by a self-regulating attestation client. The attestation client requests a credential of health from an attestation service, which includes an ordered attestation log and proof of integrity and freshness of the log. The attestation client receives the requested credential of health, which certifies the attestation client was healthy when it requested the credential of health and that the attestation service trusts the attestation client to be healthy each time the attestation client authenticates using the credential of health. The attestation client receives a request to authenticate that it is healthy using the credential of health, verifies that it is currently healthy, and performs the requested authentication.