Trusted State Attestation for Heterogeneous Systems

The patent applies preliminary action by establishing an enrollment process before the managed system operates. During enrollment, the managing system captures the initial trusted state (PCR values) of the managed system and stores it as baseline data. This preliminary capture of trusted values eliminates the need for continuous maintenance and interpretation of trusted values across heterogeneous configurations, as the system only needs to compare current states against the pre-established enrollment baseline.

The patent applies parameter changes by shifting from maintaining absolute trusted values to maintaining relative trust relationships. Instead of storing and managing complex trusted values that must be interpreted across different hardware configurations, the system stores the difference (delta) between the enrollment state and current state. This parameter transformation simplifies maintenance by focusing only on changes rather than absolute values.

The patent applies continuity of useful action by extending the trust verification process from only boot time to continuous operation. The system performs periodic attestation checks during runtime, not just during boot, by continuously monitoring PCR values and comparing them against the enrollment baseline. This continuous verification eliminates the security gap that exists between boot completion and next scheduled check, maintaining protection throughout the system's operational lifecycle.

The patent applies feedback by implementing a closed-loop attestation system. The managing system receives periodic attestation reports from the managed system, compares current PCR values against the enrollment baseline, and can trigger alerts or actions when deviations are detected. This feedback mechanism enables real-time detection of malicious attacks that occur after booting, allowing the system to respond to security threats dynamically rather than waiting for the next boot cycle.