# US 12,762,239 B2 · Automatic system for dynamic attestation for device firmware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,239 B2 - Document ID: US12762239B2 - Status: Granted - Kind: B2 - Application number: 18/654,115 - Filed: 2024-05-03 - Published: 2025-11-06 - Granted: 2026-10-13 - Earliest claimed: 2024-05-03 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Prashant Dewan - Web page: https://patentgrep.com/patent/US12762239B2 ## CPC - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - H04L 9/3247: {involving digital signatures} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Examples of the present disclosure describe devices, systems, and methods for dynamically validating a device's firmware. In examples, an attestation system receives from a platform an attestation report populated with information about components in the platform. The attestation system parses the attestation report to identify web service endpoints associated with a component of the components and initializes a connection with an endpoint of the endpoints. The attestation service receives over the connection a response from the endpoint that includes a code to evaluate the validity of firmware in the component. The attestation service evaluates and confirms the validity of the firmware and transfers the response to the component. ## Claims ### Claim 1 An attestation system comprising: a processor; and memory comprising computer executable instructions that, when executed, perform operations comprising: receiving, from a platform, an attestation report comprising: information about one or more components of the platform; and an encrypted signature verifying the attestation report is provided by a valid component of the one or more components; parsing the attestation report to identify one or more web service endpoints of a vendor associated with a component of the one or more components based on at least one unique identifier of the one or more components included in the attestation report; initializing a connection with an endpoint of the one or more web service endpoints; receiving, from the endpoint, a response, wherein the response includes executable code to evaluate validity of firmware in the component of the one or more components; evaluating the validity of the firmware of the component by executing the executable code; and upon evaluating the validity of the firmware, transferring an indication of the validity of the firmware to the component. ### Claim 2 (depends on 1) The system of claim 1, wherein the information about the one or more components further includes at least one of: a unique identifier of the platform, the at least one unique identifier of the one or more components, a hash value of the firmware in each of the one or more components, and a configuration of one or more features of the firmware in each of the one or more components. ### Claim 3 (depends on 2) The system of claim 2, wherein parsing the attestation report to identify one or more endpoints to connect with the vendor further comprises: verifying the encrypted signature to confirm that the attestation report is from a valid component of the one or more components of the platform; and determining the one or more endpoints based on a unique identifier of the valid component. ### Claim 4 (depends on 2) The system of claim 2, wherein the executable code includes a hash value of a latest firmware of the component. ### Claim 5 (depends on 4) The system of claim 4, wherein evaluating validity of the firmware comprises: comparing the hash value of the latest firmware of the component to a hash value of a firmware of the component in the attestation report; and upon finding a match, confirming the validity of the firmware. ### Claim 6 (depends on 5) The system of claim 5, wherein the operations further comprise: upon not finding a match, transmitting to the component a command to enter recovery mode. ### Claim 7 (depends on 1) The system of claim 1, wherein the executable code includes an updated configuration of the component. ### Claim 8 (depends on 2) The system of claim 2, wherein transferring the response to the component further comprises: requesting the component to replace the configuration of the component with an updated configuration in the response. ### Claim 9 (depends on 1) The system of claim 1, wherein evaluating the validity of the firmware of the component comprises: upon determining the firmware needs to be updated, transmitting to the component a command to enter recovery mode. ### Claim 10 (depends on 1) The system of claim 1, wherein the information about the one or more components of the platform is formatted as a JavaScript Object Notation (JSON) file. ### Claim 11 (depends on 1) The system of claim 1, wherein the operations further comprise: storing the response in a cache storage associated with the attestation system. ### Claim 12 A computer implemented method for dynamic verification of an attestation report on a system, the method comprises: receiving, from a platform, the attestation report comprising: information about one or more components of the platform; and an encrypted signature verifying the attestation report is provided by a valid component of the one or more components; parsing the attestation report to identify one or more web service endpoints of a vendor associated with a component of the one or more components based on at least one unique identifier of the one or more components included in the attestation report; initializing a connection with an endpoint of the one or more web service endpoints; receiving, from the endpoint, a response, wherein the response includes executable code to evaluate validity of firmware in the component of the one or more components; evaluating the validity of the firmware of the component by executing the executable code; and upon evaluating the validity of the firmware, transferring an indication of the validity of the firmware to the component. ### Claim 13 (depends on 12) The method of claim 12, wherein the information about the one or more components further includes at least one of: a unique identifier of the platform, the at least one unique identifier of the one or more components, a hash value of the firmware in each of the one or more components, and a configuration of one or more features of the firmware in each of the one or more components. ### Claim 14 (depends on 13) The method of claim 13, wherein parsing the attestation report to identify one or more endpoints to connect with the vendor further comprises: verifying the encrypted signature to confirm that the attestation report is from a valid component of the one or more components of the platform; and determining the one or more endpoints based on a unique identifier of the valid component. ### Claim 15 (depends on 13) The method of claim 13, wherein the executable code includes a hash value of a latest firmware of the component. ### Claim 16 (depends on 15) The method of claim 15, wherein evaluating validity of the firmware comprises: comparing the hash value of the latest firmware of the component to a hash value of a firmware of the component in the attestation report; and upon finding a match, confirming the validity of the firmware. ### Claim 17 (depends on 16) The method of claim 16, wherein the method further comprises: upon not finding a match, transmitting to the component a command to enter recovery mode. ### Claim 18 (depends on 12) The method of claim 12, wherein evaluating the validity of the firmware of the component comprises: upon determining the firmware needs to be updated, transmitting to the component a command to enter recovery mode. ### Claim 19 An attestation system comprising: a processor; and memory comprising computer executable instructions that, when executed, perform operations comprising: receiving, from a platform, an attestation report comprising: information about one or more components of the platform, wherein the information includes configuration of one or more features of firmware in each of the one or more components; and an encrypted signature verifying the attestation report is provided by a valid component of the one or more components; parsing the attestation report to identify one or more web service endpoints of a vendor associated with a component of the one or more components based on at least one unique identifier of the one or more components included in the attestation report; initializing a connection with an endpoint of the one or more web service endpoints; receiving, from the endpoint, a response, wherein the response includes executable code to evaluate validity of the firmware of the component; evaluating the validity of the firmware of the component by executing the executable code; and upon evaluating the validity of the firmware, transferring an indication of the validity of the firmware to the component. ### Claim 20 (depends on 19) The system of claim 19, wherein the information about the one or more components further includes at least one of: a unique identifier of the platform, the at least one unique identifier of the one or more components, a hash value of the firmware in each of the one or more components, and a configuration of one or more features of the firmware in each of the one or more components.