Trusted Execution Environment for Privacy-Preserving Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems, such as DAA and EPID, are vulnerable to quantum computers and lack secure alternatives, compromising privacy and security in electronic communications, especially when relying on trusted third parties.
Innovation Solution
Implementing a trusted execution environment with anonymous attestation mechanisms, using identifiable platform attestation key pairs and anonymous certificates, and integrating auditing services to ensure privacy and security without relying on trusted third parties, while allowing for verifier policies and key revocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key cryptography is used for authentication, then authenticity and confidentiality are ensured, but private keys must be kept secret which creates security vulnerabilities when relying on trusted third parties
Solution Approach 1:
The patent extracts the trusted third party functionality from the client device by implementing it within a trusted execution environment (TEE) on the server side. The TTP application runs in an isolated, secure environment on the server, removing the need for clients to trust external third parties while maintaining authentication security.
Solution Approach 2:
The patent introduces a trusted execution environment as an intermediary between the client and server. The TEE acts as a secure mediator that performs authentication and key management operations without exposing private keys, resolving the contradiction between security and trusted party dependency.
2Reliability
If verifiers require authentication of client platforms, then service security is improved, but user privacy is compromised as verifiers can determine authentication information originates from the same client platform
Solution Approach 1:
The patent segments the authentication system into multiple components: platform attestation (proving the client is legitimate) and user identity (keeping privacy protected). By using anonymous certificates issued by the TTP, the system separates these functions so verifiers can confirm service security without accessing user identity information.
Solution Approach 2:
The patent implements asymmetric information disclosure where the client platform proves its authenticity through cryptographic attestations while the user's identity remains hidden. The TTP issues anonymous certificates that provide verification capability without revealing identifying information, creating an asymmetric relationship between authentication and privacy.
3Reliability
If existing cryptographic systems like DAA and EPID are used, then anonymous authentication is enabled, but quantum computers can compromise privacy and security
Solution Approach 1:
The patent changes the cryptographic parameters and algorithms used in the authentication system to be quantum-resistant. By implementing post-quantum cryptographic primitives in the TEE, the system maintains security against both classical and quantum computational attacks while preserving anonymous authentication capabilities.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method, apparatus, and computer-readable medium providing instructions to cause a computing device to establish a portion of a memory of the computing device as a trusted execution environment and execute a trusted third party application within the trusted execution environment. The trusted third party application is to receive a signed public key and an identifier for a verifier from a user client attestation application executing on a client platform. The signed public key is signed with an identifiable platform attestation private key for the client platform. The trusted third party application is further to verify the signed public key, determine a policy of the verifier, encode the policy into a trusted third party anonymous certificate for the signed public key, issue the trusted third party anonymous certificate without including identification information of the client platform, and send the trusted third party anonymous certificate to the user client attestation application.