Remote attestation of modular devices with multiple cryptoprocessors
AssigneeCisco Technology, Inc.
InventorsShwetha Subray Bhandari, Eric Voit, Jesse Daniel Backman, Robert Stephen Rodgers, Joseph Eryx Malcolm
Life of this patent
Estimating the term…
Abstract
A methodology for requesting at least one signed security measurement from at least one module is provided. The methodology includes receiving the at least one signed security measurement from the at least one module; validating the at least one signed security measurement; generating a signed dossier including all validated signed security measurements in a secure enclave, the signed dossier being used by an external network device for remote attestation of the device.
Claims20
A method comprising:
- requesting at least one signed security measurement from at least one module, the at least one module existing within a physical device;
- receiving the at least one signed security measurement from the at least one module;
- validating the at least one signed security measurement;
- and
- generating a signed dossier including all validated signed security measurements in a secure enclave, the signed dossier being used by an external network device for remote attestation of the physical device;
- wherein the generating the signed dossier includes signing the dossier with a key which represents a virtual device representation of the physical device and is not tied to a specific hardware component associated with the physical device.
A non-transitory computer-readable storage medium comprising instructions stored therein which, when executed by at least one processor, cause the at least one processor to:
- request a plurality of signed security measurements from a plurality of modules, the plurality of modules existing within a physical device;
- receive the plurality of signed security measurements from the plurality of modules;
- validate the plurality of signed security measurement;
- and
- generate a signed dossier including all validated signed security measurements in a secure enclave, the signed dossier being used by an external network device for remote attestation of the physical device;
- wherein the generate the signed dossier includes signing the dossier with a key which represents a virtual device representation of the physical device and is not tied to a specific hardware component associated with the physical device.
A system comprising:
- at least one processor;
- a non-transitory computer-readable storage medium comprising instructions stored therein which, when executed by at least one processor, cause the system to:
- request a plurality of signed security measurements from a plurality of modules, the plurality of modules existing within a physical device;
- receive the plurality of signed security measurements from the plurality of modules;
- validate the plurality of signed security measurement;
- and
- generate a signed dossier including all validated signed security measurements in a secure enclave, the signed dossier being used by an external network device for remote attestation of the physical device;
- wherein the generate the signed dossier includes signing the dossier with a key which represents a virtual device representation of the physical device and is not tied to a specific hardware component associated with the physical device.
Dependencies are inferred from the claim text.