Platform health verification
A method comprises issuing a challenge to a target computing device, receiving, from the target computing device, a response to the challenge, the response comprising a self-attestation proof, a root of trust (RoT) certificate, and a set of current attestation measurements, and generating a signal indicative of a security status of the target based upon a determination of whether the set of current attestation measurements match a set of expected attestation measurements for the target computing device.
1 . A method comprising:
issuing, by a computing device, a challenge to a target computing device;
receiving, from the target computing device, a response to the challenge, the response comprising one or more of a self-attestation proof, a root of trust certificate, or a set of current attestation measurements; and
generating a signal indicative of a security status relating to the target computing device based on whether the set of current attestation measurements matches a set of expected attestation measurements associated with the target computing device, wherein the signal indicative of the security status is presented via an interface associated with the target computing device, wherein the expected attestation measurements are associated with the target computing device and obtained based on an appraisal of the target computing device in an isolated environment such that sensitive information is secured prior to interaction with the target computing device.
2 . The method of claim 1 , further comprising:
establishing an out-of-band (OOB) communication channel with the target computing device, wherein the signal comprises one or more of a visual indicator presented on a display; an audible indicator; or a tactile indicator;
obtaining, from a trusted third party, the set of expected attestation measurements associated with the target computing device;
transmitting the security status relating to the target computing device to the trusted third party; and
storing the security status relating to the target computing device.
3 . The method of claim 1 , wherein the computing device comprises a processor including an application processor or a graphics processor.
4 . A computing device comprising:
processor circuitry coupled to a memory, the processor circuitry to:
issue a challenge to a target computing device;
receive, from the target computing device, a response to the challenge, the response comprising one or more of a self-attestation proof, a root of trust certificate, or a set of current attestation measurements; and
generate a signal indicative of a security status relating to the target computing device based on whether the set of current attestation measurements matches a set of expected attestation measurements associated with the target computing device, wherein the signal indicative of the security status is presented via an interface associated with the target computing device, wherein the expected attestation measurements are associated with the target computing device and obtained based on an appraisal of the target computing device in an isolated environment such that sensitive information is secured prior to interaction with the target computing device.
5 . The computing device of claim 4 , wherein the processor circuitry is further to:
establish an out-of-band (OOB) communication channel with the target computing device, wherein the signal comprises one or more of a visual indicator presented on a display; an audible indicator; or a tactile indicator;
obtain, from a trusted third party, the set of expected attestation measurements associated with the target computing device
transmit the security status relating to the target computing device to the trusted third party; and
store the security status relating to the target computing device.
6 . The computing device of claim 4 , wherein the processor circuitry comprises application processor circuitry or graphics processor circuitry.
7 . At least one non-transitory computer-readable medium having stored thereon instructions which, when executed, cause a computing device to perform operations comprising:
issuing a challenge to a target computing device;
receiving, from the target computing device, a response to the challenge, the response comprising one or more of a self-attestation proof, a root of trust certificate, or a set of current attestation measurements; and
generating a signal indicative of a security status relating to the target based on whether the set of current attestation measurements matches a set of expected attestation measurements associated with the target computing device, wherein the signal indicative of the security status is presented via an interface associated with the target computing device, wherein the expected attestation measurements are associated with the target computing device and obtained based on an appraisal of the target computing device in an isolated environment such that sensitive information is secured prior to interaction with the target computing device.
8 . The non-transitory computer-readable medium of claim 7 , wherein the operations further comprise:
establishing an out-of-band (OOB) communication channel with the target computing device, wherein the signal comprises one or more of a visual indicator presented on a display; an audible indicator; or a tactile indicator;
obtaining, from a trusted third party, the set of expected attestation measurements for the target computing device;
transmitting the security status relating to the target computing device to the trusted third party; and
storing the security status relating to the target computing device.
9 . The computer-readable medium of claim 7 , wherein the computing device comprises one or more processors including one or more application processors or one or more graphics processors.