TEE Trust Propagation for Scalable Remote Device Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing trust between devices in large-scale peer-to-peer attested networks is computationally expensive, particularly as the network size increases, due to the quadratic growth of trust establishment operations.
Innovation Solution
A system utilizing trusted execution environment (TEE) circuitry to perform remote attestations, maintain lists of trusted devices, and propagate trust through an epidemic protocol, allowing devices to establish trust efficiently by sharing attestation data and extending trust chains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pairwise trust establishment is performed between all nodes in a peer-to-peer network, then mutual trust is established between all nodes, but the computational cost grows quadratically with network size
Solution Approach 1:
The patent merges multiple pairwise trust establishment operations into a single group attestation protocol. Instead of requiring N*(N-1)/2 separate attestation operations for N nodes, the system performs a single group attestation where all nodes simultaneously establish mutual trust, reducing computational complexity from quadratic to linear or constant time.
Solution Approach 2:
The group attestation protocol serves multiple functions simultaneously: it establishes trust between all pairs of nodes, validates the entire group's trustworthiness, and generates a collective attestation certificate that can be used for future interactions, eliminating the need for repeated pairwise attestations.
2Reliability
If remote attestation is performed for each device in a large network, then trust is verified for each device, but network traffic increases significantly
Solution Approach 1:
The patent combines multiple individual remote attestation requests into a single group attestation transaction. Instead of generating separate attestation traffic for each device pair, the system transmits one group attestation request and receives one group attestation response, dramatically reducing network traffic while maintaining verification of all devices.
Solution Approach 2:
The group attestation protocol generates a single collective attestation certificate that serves as a copyable proof of trust for all devices in the group. This certificate can be distributed and verified without requiring repeated transmission of individual device attestations, reducing redundant network traffic.
Data Source
AI summary
Aspects of the present disclosure relate to an apparatus comprising TEE circuitry configured to maintain a list of trusted devices, and interface circuitry to provide communication between the TEE of the apparatus and TEE circuitry of a device communicatively coupled to the apparatus. The TEE circuitry of the apparatus is configured to perform, with the TEE circuitry of the device, a remote attestation in respect of the TEE circuitry of the device. Responsive to a positive outcome of the remote attestation, the device is added to the list of trusted devices. The TEE of the apparatus receives, from the TEE circuitry of the device, an indication of one or more further devices which are trusted by the device, and adds said one or more further devices to the list of trusted devices.