Hardware-Based Trust ID Generation for Cloud Workload Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current approaches to forming trusted computing pools, such as Intel's Trusted Execution Technology, face challenges in ensuring the integrity and geolocation-based trust of cloud workloads due to vulnerabilities in software-based hypervisor management and the inability to uniquely identify virtual machines with physical hosts, leading to potential spoofing and forensic issues.
Innovation Solution
A trust control management method that generates a unique encoded alphanumeric Trust ID value by combining user-defined and hardware-specific values using an encoding algorithm, storing it in hardware, and performing attestation to verify the trust status of a computer system, thereby providing robust and foolproof verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-based hypervisor management is used, then ease of operation is improved, but reliability deteriorates due to potential spoofing and inability to uniquely identify virtual machines with physical hosts
Solution Approach 1:
The patent replaces software-based hypervisor management with hardware-based trust verification using a Trusted Platform Module (TPM). The TPM generates and stores cryptographic keys and attestation information in hardware, providing tamper-resistant verification of the hypervisor and virtual machine integrity. This substitution of software with hardware-based security mechanisms resolves the contradiction by maintaining ease of operation while significantly improving reliability and preventing spoofing.
Solution Approach 2:
The patent introduces a TPM as an intermediary between the hypervisor and the verification system. The TPM acts as a trusted mediator that generates attestation information about the hypervisor and virtual machine state, which can be verified by external parties without exposing sensitive information. This intermediary mechanism enables reliable trust verification while maintaining the operational simplicity of software-based hypervisor management.
2Measurement precision
If conventional attestation methods are used, then measurement of trust status is possible, but measurement precision deteriorates due to potential spoofing of attestation information
Solution Approach 1:
The patent replaces conventional software-based attestation with hardware-based attestation using the TPM. The TPM stores cryptographic keys and generates attestation information in a tamper-resistant hardware environment, making it computationally infeasible to spoof the attestation. This substitution significantly improves both the precision of trust status measurement and the reliability of attestation integrity.
Solution Approach 2:
The patent performs preliminary establishment of trust roots in the TPM during system initialization. The TPM pre-generates cryptographic key pairs and stores them in secure hardware before any virtualization operations begin. This preliminary action ensures that subsequent attestation operations are based on predetermined, tamper-resistant credentials, improving both measurement precision and reliability.
3Reliability
If hardware-based trust verification is implemented, then reliability is improved, but device complexity increases due to additional hardware components and attestation procedures
Solution Approach 1:
The patent leverages the TPM's multi-functional capabilities to perform multiple security functions within a single hardware component. The TPM handles key generation, key storage, attestation information generation, and cryptographic operations, eliminating the need for multiple separate security hardware components. This universal approach improves reliability while minimizing the increase in device complexity.
Solution Approach 2:
The TPM provides self-service security functions by autonomously generating cryptographic keys, storing them securely, and producing attestation information without requiring external security hardware or complex management infrastructure. This self-service capability reduces system complexity while maintaining high reliability through hardware-based security operations.
Data Source
AI summary
A trust control management method for security, operable on a computer system generates a unique Trust ID value by combining user-defined values with hardware-specific values associated with the user's computer system and storing the Trust ID value in a memory register physically associated with the hardware of the computer system. A Trust Control Suite (TCS) operable with a server OS/hypervisor maintains a database of user-defined values and hardware-specific values for computer systems clustered in a trusted computing pool. An attestation procedure is performed by the trust control server combining the user-defined values with the hardware-specific values from its database and comparing it to the user-stored Trust ID value stored in the memory register associated with a user's computer system. Depending on whether it is a match or mismatch, the TCS can determine if it is a trusted computer or not, and can take appropriate alerts and policy actions.