Key-Attestation-Contingent Certificate Issuance

A health service system comprising a health server computer, wherein the health server computer includes a processor in electronic communication with a memory, the memory storing computer-readable instructions that when executed by the processor cause the health server computer to:

• receive a health certificate request, a key attestation claim, and a health attestation claim from a client computer;
• verify the key attestation claim;
• verify the health attestation claim;
• create a health certificate for the client computer;
• generate a server key in response to receiving the health certificate request;
• encrypt the health certificate for the client computer with the server key to form an encrypted health certificate;
• encrypt the server key with a TPM public endorsement key associated with the client computer to form an encrypted server key;
• and
• send the encrypted health certificate with encrypted server key to the client computer.

A computer-implemented method for obtaining a certificate based on TPM key attestation for a client device, wherein the client device includes a TPM with a public endorsement key, a private endorsement key, an endorsement key certificate, and a public attestation identity key, and a private attestation identity key, the method comprising:

• creating a key claim comprising the public attestation identity key and the public endorsement key from the TPM;
• signing the key claim with the private attestation identity key from the TPM;
• sending a request for a certificate to a certificate issuing service with the key claim and the endorsement key certificate from the TPM;
• receiving a blob from the certificate issuing service, wherein the blob comprises an encrypted server key and an encrypted certificate;
• parsing the blob to retrieve the encrypted server key and the encrypted certificate;
• using the private endorsement key from the TPM to decrypt the encrypted server key;
• and
• using the decrypted server key to decrypt the certificate.