International Business Machines Corporation

Jonathan A Poritz

Elsie A Van Herreweghen

Matthias Schunter

Michael Waidner

Luke James O'Connor

Jan Leonhard Camenisch

Bernhard Jansen

Roger Daniel Zimmermann

A method and apparatus for attesting the configuration of a computing platform to a verifier. A signature key (SK) is bound to the platform and bound to a defined configuration of the platform. A credential (C(SK), C(SK)) for the signature key (SK) is obtained from an evaluator. This credential (C(SK), C(SK)) certifies that the signature key (SK) is bound to an unspecified trusted platform configuration. The platform can then demonstrate to the verifier the ability to sign a challenge from the verifier using the signature key (SK), and demonstrate possession of the credential (C(SK), C(SK)) to the verifier, thereby attesting that the platform has a trusted configuration without disclosing the platform configuration to the verifier.

Attestation of computing platforms

A method and system for verifying authenticity of an application in a computing-platform operating in a Trusted Computing Group (TCG) domain is provided. The method includes computing one or more integrity measurements corresponding to one or more of the application, a plurality of precedent-applications, and an output file. The output file includes an output of the application, the application is executing on the computing-platform. Each precedent-application is executed before the application. The method further includes comparing one or more integrity measurements with re-computed integrity measurements. The re-computed integrity measurements are determined corresponding to one or more of the application, the plurality of precedent-applications, and the computing-platform.

Method and system to authenticate an application in a computing platform operating in trusted computing group (TCG) domain

Method and device for verifying the security of a computing platform. In the method for verifying the security of a computing platform a verification machine is first transmitting a verification request via an integrity verification component to the platform. Then the platform is generating by means of a trusted platform module a verification result depending on binaries loaded on the platform, and is transmitting it to the integrity verification component. Afterwards, the integrity verification component is determining with the received verification result the security properties of the platform and transmits them to the verification machine. Finally, the verification machine is determining whether the determined security properties comply with desired security properties.

Method and device for verifying the security of a computing platform

Growing community of inventors

Colorado Springs, CO, United States of America

Jonathan A Poritz