Method for end entity attestation
AssigneeHuawei Technologies Co., Ltd.
InventorsSampo Sovio, Jan-Erik Ekberg
Life of this patent
Estimating the term…
Abstract
A method for attestation of Control Flow Integrity (CFI) of an application running on an end entity whereby an asymmetric key pair is generated by a Key Management Module (KMM) comprising a private key and a public key, then the public key is signed with a device key unique to the end entity thereby generating a public key certificate which attests to the private key being in possession of the end entity. The asymmetric key pair is based on the executing code of the application and the device key. The attestation claims regarding CFI of the application are signed by the private key in a dedicated signature module.
Claims17
A computer-implemented method for attestation of Control Flow Integrity (CFI) of an application running on an end entity, the method comprising:
- generating an asymmetric key pair based on executing code of said application and a device key unique to said end entity, said asymmetric key pair comprising a private key and a public key,
- generating a public key certificate by signing said public key with said device key, wherein said public key certificate attests to said private key being in possession of said end entity,
- generating attestation claims regarding CFI of said application,
- signing said attestation claims by said private key, and
- validating the signature of said attestation claims by a relying party using said public key certificate,
- wherein said relying party is not part of said end entity, and
- wherein the generating said asymmetric key pair is based on a secure hash calculated from a text segment of the executing code of said application using a keyed-hash function.
A computer-based system comprising:
- a relying party, and
- an end entity connected to said relying party, said end entity comprising a processor, a storage medium connected to said processor, and
- an assigned unique device key, wherein
- said storage medium is configured to store executing code of an application, and remote attestation instructions, wherein
- when said remote attestation instructions are executed by said processor the attestation instructions cause said end entity and said relying party to perform a method comprising:
- generating an asymmetric key pair based on executing code of said application and the unique device key, said asymmetric key pair comprising a private key and a public key,
- generating a public key certificate by signing said public key with said unique device key, wherein said public key certificate attests to said private key being in possession of said end entity,
- generating attestation claims regarding CFI of said application,
- signing said attestation claims by said private key, and
- validating the signature of said attestation claims by the relying party using said public key certificate,
- wherein said relying party is not part of said end entity, and
- wherein the generating said asymmetric key pair is based on a secure hash calculated from a text segment of the executing code of said application using a keyed-hash function.
Dependencies are inferred from the claim text.