# US 10,482,034 B2 · Remote attestation model for secure memory applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,034 B2 - Document ID: US10482034B2 - Status: Granted - Kind: B2 - Application number: 15/364,044 - Filed: 2016-11-29 - Published: 2018-05-31 - Granted: 2019-11-19 - Earliest claimed: 2016-11-29 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Lei Kou; Pushkar Vijay Chitnis; Simon Leet - Web page: https://patentgrep.com/patent/US10482034B2 ## CPC - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/123: {received data contents, e.g. message integrity} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Instantiating an attestation facilitation component that allows a remote application to attest to a secure state of a secure memory application executing upon a secure platform of a computer system regardless of a type of either the secure platform or a health attestation service. Instantiation comprises identifying a property that includes at least one of the secure platform type and the health attestation service type. The instantiation is customized with the identified property. The attestation facilitation component verifies that a report generated by the secure platform represents that the secure memory application is operating in a secure state, and accesses a token generated by the health attestation service that represents that the secure platform is operating in a secure state. The attestation facilitation component generates a quote that allows the remote application to verify that the secure platform and the secure memory application are both operating in secure states. ## Claims ### Claim 1 A computer system comprising: one or more processors; and one or more computer-readable storage media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computer system to instantiate an attestation facilitation component that is enabled to provide verification to an application that is remote from the computer system of a secure state of a secure memory application (SMA) executing upon a secure platform of the computer system regardless of a type of the secure platform and a type of a health attestation service, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following: instantiate an attestation facilitation component; identify at least one property including at least one of (i) a particular type of the secure platform upon which the SMA is executing from a plurality of different types of secure platforms and (ii) the type of the health attestation service from a plurality of different types of health attestation services; customize the instantiation of the attestation facilitation component with the at least one identified property; and the customized instance of the attestation facilitation component performing at least the following: verifying that a report generated by the secure platform represents that the secure memory application is operating within the secure platform; accessing a token generated by the health attestation service, the generated token representing that the secure platform is operating in a secure state; and generating a quote that is usable by the remote application to verify that the secure platform and the secure memory application are both operating in secure states, the quote being based on at least a portion of the generated report and a portion of the generated token. ### Claim 2 (depends on 1) The computer system in accordance with claim 1, wherein both the type of the secure platform and the type of the health attestation service are identified. ### Claim 3 (depends on 1) The computer system in accordance with claim 1, wherein accessing the token comprises using the token to access a signing key. ### Claim 4 (depends on 3) The computer system in accordance with claim 3, wherein the signing key is used to sign the generated quote. ### Claim 5 (depends on 1) The computer system in accordance with claim 1, wherein the generated quote is sent to the remote application for verification that the secure platform and the secure memory application are both operating in secure states. ### Claim 6 (depends on 1) The computer system in accordance with claim 1, wherein the instantiated attestation facilitation component comprises an instance of a class of attestation facilitation component that is customizable to function with a plurality of secure platform types and a plurality of health attestation service types. ### Claim 7 (depends on 1) The computer system in accordance with claim 1, wherein the attestation facilitation component comprises a software development kit that acts as an abstraction layer for the remote application with respect to the type of at least one of the secure platform and the health attestation service. ### Claim 8 A method, implemented at a computer system that includes one or more processors, for instantiating an attestation facilitation component that is enabled to provide verification to an application that is remote from the computer system of a secure state of a secure memory application (SMA) executing upon a secure platform of the computer system regardless of a type of the secure platform and a type of a health attestation service, comprising: instantiating an attestation facilitation component, the instantiation comprising: identifying at least one property including at least one of (i) a particular type of the secure platform upon which the SMA is executing from a plurality of different types of secure platforms and (ii) the type of the health attestation service from a plurality of different types of health attestation services; customizing the instantiation of the attestation facilitation component with the at least one identified property, the customized instance of the attestation facilitation component performing at least the following: verifying that a report generated by the secure platform represents that the secure memory application is operating within the secure platform; accessing a token generated by the health attestation service, the generated token representing that the secure platform is operating in a secure state; and generating a quote that is usable by the remote application to verify that the secure platform and the secure memory application are both operating in secure states, the quote being based on at least a portion of the generated report and a portion of the generated token. ### Claim 9 (depends on 8) The method in accordance with claim 8, wherein both the type of the secure platform and the type of the health attestation service are identified. ### Claim 10 (depends on 8) The method in accordance with claim 8, further comprising using the token to access a signing key. ### Claim 11 (depends on 10) The method in accordance with claim 10, wherein the signing key is used to sign the generated quote. ### Claim 12 (depends on 10) The method in accordance with claim 10, further comprising sending the quote to the remote application for verification that the secure platform and the secure memory application are both operating in secure states. ### Claim 13 (depends on 12) The method in accordance with claim 12, wherein the instantiated attestation facilitation component comprises an instance of a class of attestation facilitation component that is customizable to function with a plurality of secure platform types and a plurality of health attestation service types. ### Claim 14 (depends on 13) The method in accordance with claim 13, wherein the attestation facilitation component comprises a software development kit that acts as an abstraction layer for the remote application with respect to the type of at least one of the secure platform and the health attestation service. ### Claim 15 A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system to instantiate an attestation facilitation component that is enabled to provide verification to an application that is remote from the computer system of a secure state of a secure memory application (SMA) executing upon a secure platform of the computer system regardless of a type of the secure platform and a type of a health attestation service, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following: instantiate an attestation facilitation component; identify at least one property including at least one of (i) a particular type of the secure platform upon which the SMA is executing from a plurality of different types of secure platforms and (ii) the type of the health attestation service from a plurality of different types of health attestation services; customize the instantiation of the attestation facilitation component with the at least one identified property; and the customized instance of the attestation facilitation component performing at least the following: verifying that a report generated by the secure platform represents that the secure memory application is operating within the secure platform; accessing a token generated by the health attestation service, the generated token representing that the secure platform is operating in a secure state; and generating a quote that is usable by the remote application to verify that the secure platform and the secure memory application are both operating in secure states, the quote being based on at least a portion of the generated report and a portion of the generated token. ### Claim 16 (depends on 15) The computer program product in accordance with claim 15, wherein both the type of the secure platform and the type of the health attestation service are identified. ### Claim 17 (depends on 15) The computer program product in accordance with claim 15, wherein accessing the token comprises using the token to access a signing key. ### Claim 18 (depends on 17) The computer program product in accordance with claim 17, wherein the signing key is used to sign the generated quote. ### Claim 19 (depends on 15) The computer program product in accordance with claim 15, wherein the generated quote is sent to the remote application for verification that the secure platform and the secure memory application are both operating in secure states. ### Claim 20 (depends on 15) The computer program product in accordance with claim 15, wherein the instantiated attestation facilitation component comprises an instance of a class of attestation facilitation component that is customizable to function with a plurality of secure platform types and a plurality of health attestation service types.