Trust Anchor Module for Cryptographic Geolocation Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing geolocation techniques in cloud environments are inconsistent and can be subverted, failing to provide trusted data geolocation due to incompatible legislation and compliance requirements across jurisdictions, especially with the increasing mobility of data centers.
Innovation Solution
A root-of-trust geolocation system that includes a trust anchor module with a cryptographic processor and secure memory, which receives and stores a digital geolocation certificate, uses movement sensors and external sources like GPS and cell towers to determine and log physical location, and communicates securely to ensure the certificate's immutability and compliance with legal and policy requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing geolocation techniques are used, then device location can be obtained, but the geolocation data can be subverted and is inconsistent
Solution Approach 1:
The patent applies preliminary action by pre-establishing a root of trust in the hardware before geolocation measurements are taken. A trusted platform module (TPM) or secure element is provisioned with cryptographic credentials and a unique device identifier before the device is deployed. This pre-established trust anchor allows the system to verify the authenticity of geolocation data at a later time, preventing subversion of location information while maintaining measurement precision.
Solution Approach 2:
The patent introduces an intermediary element - a trusted platform module or secure element - that acts as a mediator between the geolocation sensors and the external system. This intermediary cryptographically signs geolocation measurements and binds them to the device identifier, creating an unforgeable link between the physical device and its location data. The intermediary prevents subversion by ensuring that only authenticated devices can provide valid geolocation evidence.
2Adaptability or versatility
If data centers are made mobile for flexibility, then adaptability improves, but geolocation verification becomes more difficult
Solution Approach 1:
The patent replaces mechanical/geographic verification methods with cryptographic verification. Instead of relying on physical inspection or fixed infrastructure verification, the system uses cryptographic signatures from the trusted platform module to verify device identity and location. This substitution allows data centers to move freely while maintaining verification reliability, as the cryptographic credentials travel with the device and can be validated remotely without physical presence.
3Stability of the object's composition
If cryptographic binding is implemented, then location immutability improves, but device complexity increases
Solution Approach 1:
The patent merges the trusted platform module with existing device hardware components, such as integrating it into the system-on-chip or combining it with the device's existing security infrastructure. By merging the cryptographic functions into the device's core architecture rather than adding separate external modules, the patent achieves location data immutability while minimizing the increase in device complexity. The trusted platform module leverages existing hardware security features to reduce overall system complexity.
Data Source
AI summary
A root-of-trust of geolocation is provided for an apparatus that includes a trust anchor module with a cryptographic processor and a secure memory. The apparatus further includes a main processor coupled to the trust anchor module and configured to receive a digital geolocation certificate, the geolocation certificate including information identifying the apparatus, information regarding a physical location of the apparatus, information identifying an authorized entity that has verified the physical location of the apparatus, and a digital signature of the authorized entity. The main processor is further configured to cause the trust anchor module to store the digital geolocation certificate in the secure memory such that the digital geolocation certificate is cryptographically bound to the apparatus. The trust anchor module may also include, or otherwise communicate over a secure channel with, a movement sensor associated with the apparatus.