Device attestation techniques

A method for a validation apparatus to validate an attestation from a device attesting to an assertion concerning the device, comprising:

• obtaining from an attestation database one or more entries, each entry comprising an attestation identifier, a validation-secret code and an assertion;
• obtaining from the device one or more attestation identifiers and a hashed-value;
• wherein prior to the obtaining from the device, the device has generated one or more validation-secret codes, each validation-secret code has been generated by the device by hashing a device-secret code using a first predetermined hash function, and wherein the hashed-value has been generated by the device hashing the one or more validation-secret codes in combination with one or more items of information locally available on the device using a second predetermined hash function;
• performing a validation operation on the one or more attestation identifiers obtained from the device together with the corresponding validation-secret codes obtained from the attestation database to validate the hashed-value obtained from the device;
• determining whether the one or more assertions associated with the one or more attestation identifiers obtained from the device are valid in respect of the device in dependence on a validation result of the validation operation.

A plurality of non-transitory, computer-readable storage media each storing a computer program, which when executed by one or more computers, controls the one or more computers to:

• generate an attestation identifier and a base-secret code corresponding to the attestation identifier;
• provide the attestation identifier and a validation-secret code to a validation apparatus for storage in conjunction with the assertion,
• wherein the validation-secret code is based on the base-secret code;
• provide the attestation identifier and a device-secret code to a manufacturer or adapter for provision to the device,
• wherein:
• the device-secret code is based on the base-secret code,
• the validation-secret code is generated by hashing the base-secret code using a first predetermined hash function,
• the device-secret code is the same as the base-secret code,
• in response to provision of the attestation identifier and the device-secret code to the device, the device-secret code is hashed using the first predetermined hash function to generate the validation-secret code, and
• the validation-secret code is further hashed in combination with one or more items of locally available information using a second predetermined hash function to generate a hashed-value.

A system comprising:

• processing circuitry to perform data processing;
• and
• data storage storing one or more computer programs, which when executed by the processing circuitry, controls the processing circuitry to:
• generate an attestation identifier and a base-secret code corresponding to the attestation identifier;
• provide the attestation identifier and a validation-secret code to a validation apparatus for storage in conjunction with the assertion,
• wherein the validation-secret code is based on the base-secret code;
• provide the attestation identifier and a device-secret code to a manufacturer or adapter for provision to a device,
• wherein the device-secret code is based on the base-secret code,
• wherein the validation-secret code is configured to be generated by hashing the base-secret code using a first predetermined hash function,
• wherein the device-secret code is the same as the base-secret code,
• in response to provision of the attestation identifier and the device-secret code to the device, hash the device-secret code using the first predetermined hash function to generate the validation-secret code, and
• further hash the validation-secret code in combination with one or more items of locally available information using a second predetermined hash function to generate a hashed-value.