Method and system for distributing attestation key and certificate in trusted computing

1. A computer-implemented method for secure attestation, the method comprising:

receiving, by a Trusted Platform Module (TPM) of a trusted platform, an attestation-key request from an application module configured to run an application on the trusted platform, wherein the attestation-key request comprises a first nonce generated by the application module;

computing an attestation public/private key pair by performing an encryption operation based on the first nonce, a second nonce generated by the TPM, and an application-identifier associated with the application;

computing TPM identity information based on both a unique identifier of the TPM and the public key of the attestation public/private key pair; and

transmitting, by the TPM, the public key of the attestation public/private key pair and the TPM identity information to the application module, thereby enabling the application module to verify the public key of the attestation public/private key pair based on the TPM identity information.

2. The computer-implemented method of claim 1 , wherein the application-identifier associated with the application is included in the attestation-key request, and wherein the application-identifier and the first nonce are protected using an asymmetric encryption technique and a public key of an endorsement public/private key pair issued to the TPM by its manufacturer.

3. The computer-implemented method of claim 2 , further comprising decrypting, by the TPM using a private key of the endorsement public/private key pair, the received request to obtain the application-identifier and the first nonce in plain text.

4. The computer-implemented method of claim 3 , further comprising:

in response to obtaining the first nonce in plain text, encrypting, by the TPM using the first nonce and a symmetric encryption technique, an endorsement certificate issued to the TPM by its manufacturer, wherein the endorsement certificate comprises the unique identifier of the TPM; and

transmitting the encrypted endorsement certificate to the application.

5. The computer-implemented method of claim 4 , further comprising:

decrypting, by the application module using the first nonce, the encrypted endorsement certificate;

extracting the unique identifier of the TPM included in the endorsement certificate;

comparing the unique identifier of the TPM extracted from the endorsement certificate and the unique identifier included in the TPM identity information in order to verify the public key of the attestation public/private key pair; and

in response to a successful verification of the public key of the attestation public/private key pair, keeping the public key of the attestation public/private key pair.

6. The computer-implemented method of claim 1 , further comprising:

transmitting, by the application module, a certificate request to a certificate authority (CA), wherein the certificate request comprises the public key of the attestation public/private key pair and the TPM identity information.

7. The computer-implemented method of claim 6 , wherein the certificate request further comprises an endorsement certificate issued to the TPM by its manufacturer, wherein the endorsement certificate comprises the unique identifier of the TPM.

8. The computer-implemented method of claim 7 , further comprising:

verifying, by the CA, the certificate request based on the unique identifier of the TPM included in the endorsement certificate and the unique identifier of the TPM included in the TPM identity information.

9. The computer-implemented method of claim 1 , wherein performing the encryption operation comprises encrypting, using a public key of an endorsement public/private key pair issued to the TPM by its manufacturer, a concatenation of the first nonce, the second nonce, and the application-identifier associated with the application.

10. The computer-implemented method of claim 1 , wherein computing the TPM identity information comprises encrypting, using a private key of the attestation public/private key pair, a collection of information that comprises at least the public key of the attestation public/private key pair and the unique identifier of the TPM.

11. A computer system, comprising:

a processor; and

a storage device coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method for secure attestation, the method comprising:

receiving, by a Trusted Platform Module (TPM) of a trusted platform, an attestation-key request from an application module configured to run an application on the trusted platform, wherein the attestation-key request comprises a first nonce generated by the application module;

computing an attestation public/private key pair by performing an encryption operation based on the first nonce, a second nonce generated by the TPM, and an application-identifier associated with the application;

computing TPM identity information based on both a unique identifier of the TPM and the public key of the attestation public/private key pair; and

transmitting, by the TPM, the public key of the attestation public/private key pair and the TPM identity information to the application module, thereby enabling the application module to verify the public key of the attestation public/private key pair based on the TPM identity information.

12. The computer system of claim 11 , wherein the application-identifier associated with the application is included in the attestation-key request, and wherein the application-identifier and the first nonce are protected using an asymmetric encryption technique and a public key of an endorsement public/private key pair issued to the TPM by its manufacturer.

13. The computer system of claim 12 , wherein the method further comprises decrypting, by the TPM using a private key of the endorsement public/private key pair, the received request to obtain the application-identifier and the first nonce in plain text.

14. The computer system of claim 13 , wherein the method further comprises:

in response to obtaining the first nonce in plain text, encrypting, by the TPM using the first nonce and a symmetric encryption technique, an endorsement certificate issued to the TPM by its manufacturer, wherein the endorsement certificate comprises the unique identifier of the TPM; and

transmitting the encrypted endorsement certificate to the application.

15. The computer system of claim 14 , wherein the method further comprises:

decrypting, by the application module using the first nonce, the encrypted endorsement certificate;

extracting the unique identifier of the TPM included in the endorsement certificate;

comparing the unique identifier of the TPM extracted from the endorsement certificate and the unique identifier included in the TPM identity information in order to verify the public key of the attestation public/private key pair; and

in response to a successful verification of the public key of the attestation public/private key pair, keeping the public key of the attestation public/private key pair.

16. The computer system of claim 11 , wherein the method further comprises:

transmitting, by the application module, a certificate request to a certificate authority (CA), wherein the certificate request comprises the public key of the attestation public/private key pair and the TPM identity information.

17. The computer system of claim 16 , wherein the certificate request further comprises an endorsement certificate issued to the TPM by its manufacturer, wherein the endorsement certificate comprises the unique identifier of the TPM.

18. The computer system of claim 17 , wherein the method further comprises:

verifying, by the CA, the certificate request based on the unique identifier of the TPM included in the endorsement certificate and the unique identifier of the TPM included in the TPM identity information.

19. The computer system of claim 11 , wherein performing the encryption operation comprises encrypting, using a public key of an endorsement public/private key pair issued to the TPM by its manufacturer, a concatenation of the first nonce, the second nonce, and an application-identifier associated with the application.

20. The computer system of claim 11 , wherein computing the TPM identity information comprises encrypting, using a private key of the attestation public/private key pair, a collection of information that comprises at least the public key of the attestation public/private key pair and the unique identifier of the TPM.

21. A computer-implemented method for obtaining an attestation key, the method comprising:

transmitting, by an application module running an application on a trusted platform, an attestation-key request to a Trusted Platform Module (TPM) associated with the trusted platform, wherein the attestation-key request comprises a first nonce;

receiving, by the application module from the TPM, a public key of an attestation public/private key pair, TPM identity information, and an endorsement certificate encrypted using the first nonce, wherein the TPM identify information and the endorsement certificate each comprises a unique identifier of the TPM, and wherein the attestation public/private key pair is computed by performing an encryption operation based on the first nonce, a second nonce generated by the TPM, and an application-identifier associated with the application;

decrypting, using the first nonce, the encrypted endorsement certificate;

extracting the unique identifier of the TPM included in the endorsement certificate;

comparing the unique identifier of the TPM extracted from the endorsement certificate and the unique identifier included in the TPM identity information in order to verify the public key of the attestation public/private key pair; and

in response to a successful verification of the public key of the attestation public/private key pair, keeping the public key of the attestation public/private key pair.

22. The computer-implemented method of claim 21 , wherein the application-identifier associated with the application is included in the attestation-key request, and wherein the application-identifier and the first nonce are protected using an asymmetric encryption technique and a public key of an endorsement public/private key pair issued to the TPM by its manufacturer.

23. The computer-implemented method of claim 21 , wherein the TPM identity information further comprises the public key of the attestation public/private key pair, and wherein the TPM identity information is protected by a private key of the attestation public/private key pair.