Signed Measurement Generation for ODM Data Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Original equipment manufacturers (OEMs) face challenges in authenticating diagnostic data from computing devices assembled by original design manufacturers (ODMs) in untrusted environments, as the lack of pre-provisioned identities and potential network adversaries can lead to falsified data submissions, compromising asset database security.
Innovation Solution
Implementing a secure component, such as a trusted platform module (TPM), with an attestation key pair and cryptographic authentication procedures to verify the identity and integrity of data collected from computing devices, ensuring that only trusted data is submitted and processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If diagnostic data is collected and sent to OEM from ODM factories, then asset tracking capability is improved, but data authenticity and security deteriorate due to untrusted environment and potential adversaries
Solution Approach 1:
The patent applies preliminary action by provisioning identity information (cryptographic key pairs) to computing devices before they are shipped to ODM factories. This pre-establishment of trusted identities enables the devices to autonomously authenticate themselves when submitting diagnostic data, ensuring data authenticity without requiring trusted intermediaries at the factory. The measurement log is also prepared in advance with expected values that will be used for later verification.
Solution Approach 2:
The patent introduces cryptographic measurements and signature verification as an intermediary mechanism between the untrusted ODM environment and the OEM. Instead of directly trusting data from the factory, the system uses cryptographic proofs (signed measurements) as an intermediary layer that validates data authenticity. The measurement log acts as a mediator that bridges the gap between device identity and diagnostic data integrity.
2Reliability
If cryptographic authentication procedures are implemented, then data security and integrity are improved, but system complexity increases
Solution Approach 1:
The patent extracts the complex cryptographic authentication logic from the main diagnostic data collection and submission flow. The authentication mechanism is isolated into separate components: identity provisioning, measurement logging, and signature verification. This extraction allows the core diagnostic functionality to remain simple while the security layer operates independently, reducing the perceived complexity in the main system flow.
Solution Approach 2:
The computing device performs self-authentication using its own provisioned identity and internal measurement log. The device autonomously generates cryptographic proofs without requiring external authentication infrastructure at the factory. This self-service approach eliminates the need for complex centralized authentication systems, reducing overall system complexity while maintaining strong security.
Data Source
AI summary
In an example, a tangible machine-readable medium includes instructions which, when executed on at least one processor, cause the at least one processor to obtain an attestation public key bound to an identity associated with a root of trust of a platform. The instructions further cause the at least one processor to obtain a trusted time stamp associated with data collection by the platform. The instructions further cause the at least one processor to generate a signed measurement based on a trusted input as a nonce.