Measured boot and attestation for distributed edge devices in air-gapped environments

Abstract

A computer-implemented method for establishing trustworthiness of an Edge Computing Device may include predicting a platform configurable register (PCR) value for a system update to generate a predicted PCR value, and then storing the predicted PCR value. The method may further include running the system update by storing updated software on the Edge Computing Device, measuring one or more aspects of the updated software to generate a measured PCR value, comparing the measured PCR value with the predicted PCR value to determine that the measured PCR value matches the predicted PCR value. Responsive to determining that the measured PCR value matches the predicted PCR value, secret information may be transmitted. Predicting the PCR value may include using a TPM log to generate a pre-calculated hash of one or more changed parts of the updated software. Enhanced Authorization may be used to generate an authorization policy including the predicted PCR value.