# US 12,113,823 B2 · Remote attestation method and device for composite device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,823 B2 - Document ID: US12113823B2 - Status: Granted - Kind: B2 - Application number: 17/720,848 - Filed: 2022-04-14 - Published: 2022-07-28 - Granted: 2024-10-08 - Earliest claimed: 2019-10-17 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Junli Hu; Wei Pan; Haifei Zeng; Yuguo Wang - Web page: https://patentgrep.com/patent/US12113823B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 1/3206: Monitoring of events, devices or parameters that trigger a change in power modality - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/1433: {Vulnerability analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A remote attestation method includes a first unit of a composite device obtains first measurement information of a second unit of the composite device. The first unit performs, based on the first measurement information, trustworthiness attestation on the second unit to obtain a first attestation result, and the first unit sends the first attestation result to a remote attestation device. In this way, the first unit in the composite device has a remote attestation function, and may perform trustworthiness attestation on another unit in the composite device to which the first unit belongs. ## Claims ### Claim 1 A composite device comprising: a second communication entity that does not comprise any communications interface configured to directly communicate with an external device; and a first communication entity coupled to the second communication entity, wherein the first communication entity is a leader unit comprising a communications interface configured to directly communicate with the external device, wherein the composite device comprises a router, a switch, or a packet transport network (PTN) device, and wherein the first communication entity is configured to: obtain first measurement information of the second communication entity; perform, based on the first measurement information, trustworthiness attestation on the second communication entity to obtain a first attestation result; and send the first attestation result to a remote attestation device. ### Claim 2 (depends on 1) The composite device of claim 1, wherein the first measurement information comprises a first platform configuration register (PCR) value and a PCR reference value. ### Claim 3 (depends on 1) The composite device of claim 1, wherein the first measurement information comprises: a second platform configuration register (PCR) value from the second communication entity; a first measurement log from the second communication entity, wherein the first measurement log comprises a first baseline value from the second communication entity and information about a process of extending the first baseline value to obtain the second PCR value; and a second baseline value configured to check the first baseline value, wherein the second baseline value is a trusted baseline value of the second communication entity. ### Claim 4 (depends on 1) The composite device of claim 1, further comprising a third communication entity coupled to the first communication entity, wherein the first communication entity is further configured to: obtain second measurement information of the third communication entity; and send the second measurement information to the remote attestation device. ### Claim 5 (depends on 1) The composite device of claim 1, wherein before sending the first attestation result, the first communication entity is further configured to receive, from the remote attestation device, a first measurement request message requesting the first communication entity to perform the trustworthiness attestation on the composite device. ### Claim 6 (depends on 1) The composite device of claim 1, wherein the first communication entity is further configured to send second measurement information of the first communication entity to the remote attestation device. ### Claim 7 (depends on 1) The composite device of claim 1, wherein the first communication entity is further configured to: send a mode negotiation request message to the remote attestation device; receive a mode negotiation response message from the remote attestation device in response to the mode negotiation request message; and determine a remote attestation mode based on the mode negotiation response message. ### Claim 8 (depends on 7) The composite device of claim 7, wherein the remote attestation mode is a proxy mode, and wherein, in the proxy mode, the first communication entity is further configured to perform the trustworthiness attestation on all communication entities in the composite device comprising trusted computing base (TCB) modules except the first communication entity. ### Claim 9 (depends on 7) The composite device of claim 7, wherein the remote attestation mode is a mixed attestation mode, and wherein, in the mixed attestation mode, the first communication entity is further configured to perform the trustworthiness attestation on the second communication entity. ### Claim 10 (depends on 1) The composite device of claim 1, wherein the first communication entity is further configured to: send, to the remote attestation device, a first request message requesting an attestation permission from the remote attestation device, wherein the attestation permission indicates a set of communication entities on which the first communication entity performs the trustworthiness attestation, and wherein the set comprises the second communication entity; and receive, from the remote attestation device in response to the first request message, a first response message indicating the attestation permission. ### Claim 11 (depends on 1) The composite device of claim 1, wherein the first communication entity is further configured to periodically perform the trustworthiness attestation on the second communication entity. ### Claim 12 (depends on 1) The composite device of claim 1, wherein the first communication entity is further configured to further perform the trustworthiness attestation on the second communication entity based on triggering of an event. ### Claim 13 (depends on 12) The composite device of claim 12, wherein the event comprises one of: an active/standby switchover of the first communication entity; a state change of the second communication entity; or a configuration command. ### Claim 14 (depends on 1) The composite device of claim 1, wherein the first communication entity is further configured to: obtain second measurement information corresponding to an incremental change when the second communication entity has the incremental change; and further perform the trustworthiness attestation on the second communication entity based on the second measurement information. ### Claim 15 A remote attestation device comprising: a first communications interface; and one or more processors coupled to the first communications interface and configured to: receive, from a first communication entity of a composite device and using the first communications interface, a first message carrying a first attestation result of first trustworthiness attestation on a second communication entity of the composite device, wherein the a first communication entity is a leader unit comprising a second communications interface configured to directly communicate with an external device, wherein the second communication entity does not comprise any communications interface configured to directly communicate with the external device, and wherein the composite device comprises a router, a switch, or a packet transport network (PTN) device; and obtain the first attestation result from the first message. ### Claim 16 (depends on 15) The remote attestation device of claim 15, wherein the one or more processors are further configured to: receive, from the first communication entity and using the first communications interface, a second message carrying first measurement information of the first communication entity; and perform second trustworthiness attestation on the first communication entity based on the first measurement information to obtain a second attestation result. ### Claim 17 (depends on 15) The remote attestation device of claim 15, wherein the one or more processors are further configured to check the first attestation result to obtain a third attestation result. ### Claim 18 (depends on 15) The remote attestation device of claim 15, wherein the one or more processors are further configured to: receive, using the first communications interface, a mode negotiation request message from the first communication entity; determine a remote attestation mode based on the mode negotiation request message; and send, using the first communications interface and to the first communication entity, a mode negotiation response message carrying the remote attestation mode, wherein the mode negotiation response message instructs the first communication entity to perform remote attestation in the remote attestation mode. ### Claim 19 A first communication entity in a composite device and comprising: a memory configured to store instructions; a communications interface configured to directly communicate with an external device; and one or more processors coupled to the memory and the communications interface, wherein the instructions cause the one or more processors to be configured to: obtain first measurement information of a second communication entity of the composite device, wherein the second communication entity does not comprise any communications interface configured to directly communicate with the external device, wherein the first communication entity comprises a leader unit in the composite device, and wherein the composite device comprises a router, a switch, or a packet transport network (PTN) device; perform, based on the first measurement information, trustworthiness attestation on the second communication entity to obtain an attestation result; and send the attestation result to a remote attestation device.