Automatic system for dynamic attestation for device firmware

A computer implemented method for dynamic verification of an attestation report on a system, the method comprises:

• receiving, from a platform, the attestation report comprising:
• information about one or more components of the platform;
• and
• an encrypted signature verifying the attestation report is provided by a valid component of the one or more components;
• parsing the attestation report to identify one or more web service endpoints of a vendor associated with a component of the one or more components based on at least one unique identifier of the one or more components included in the attestation report;
• initializing a connection with an endpoint of the one or more web service endpoints;
• receiving, from the endpoint, a response, wherein the response includes executable code to evaluate validity of firmware in the component of the one or more components;
• evaluating the validity of the firmware of the component by executing the executable code;
• and
• upon evaluating the validity of the firmware, transferring an indication of the validity of the firmware to the component.

An attestation system comprising:

• a processor;
• and
• memory comprising computer executable instructions that, when executed, perform operations comprising:
• receiving, from a platform, an attestation report comprising:
• information about one or more components of the platform, wherein the information includes configuration of one or more features of firmware in each of the one or more components;
• and
• an encrypted signature verifying the attestation report is provided by a valid component of the one or more components;
• parsing the attestation report to identify one or more web service endpoints of a vendor associated with a component of the one or more components based on at least one unique identifier of the one or more components included in the attestation report;
• initializing a connection with an endpoint of the one or more web service endpoints;
• receiving, from the endpoint, a response, wherein the response includes executable code to evaluate validity of the firmware of the component;
• evaluating the validity of the firmware of the component by executing the executable code;
• and
• upon evaluating the validity of the firmware, transferring an indication of the validity of the firmware to the component.