Trusted platform module attestation flow over simple authentication and security layer with multiple symmetric key identification

One or more hardware-based non-transitory computer-readable memory devices storing instructions which, when executed by one or more processors disposed in a client computing device, cause the client computing device to perform an attestation process with a provisioning service using a Simple Authentication and Security Layer (SASL) framework, in which the executed instructions further cause the client computing device to:

• configure an SASL INIT (initialization) message with a control byte which defines message attributes including an indication that the SASL INIT message is one segment of a message having multiple segments;
• transmit the SASL INIT message;
• configure a response message which includes a public key in response to receiving a challenge to the SASL INIT message, wherein the response message is configured with a control byte that defines attributes about the response message;
• transmit the response message;
• after transmitting the public keys, receive a first segment challenge key;
• examine one or more bits within a control byte included in the first segment challenge key;
• based on the examination of the one or more bits, determine whether the first segment challenge key is an interim segment or a final segment;
• when the first segment challenge key is an interim segment, then transmit an acknowledgment of receipt of the first segment challenge key;
• and
• use the first segment challenge key in the attestation process in which a Shared Access Security (SAS) token is generated and transmitted to the provisioning service to authenticate the client computing device.

A method by which a client computing device performs an attestation process with a provisioning service using a Simple Authentication and Security Layer (SASL), comprising:

• configuring an SASL INIT (initialization) message with a control byte which defines message attributes including an indication that the SASL INIT message is one segment of a message having multiple segments;
• transmitting the SASL INIT message;
• configuring a response message which includes a public key in response to receiving a challenge to the SASL INIT message, wherein the response message is configured with a control byte that defines attributes about the response message;
• transmitting the response message;
• after transmitting the public keys, receiving a first segment challenge key;
• examining one or more bits within a control byte included in the first segment challenge key;
• based on the examination of the one or more bits, determining whether the first segment challenge key is an interim segment or a final segment;
• when the first segment challenge key is an interim segment, then transmitting an acknowledgment of receipt of the first segment challenge key;
• and
• using the first segment challenge key in the attestation process in which a Shared Access Security (SAS) token is generated and transmitted to the provisioning service to authenticate the client computing device.