System and method for providing information usable to identify trust in data
Methods and systems for managing trust in data are disclosed. Generated data may be more or less reliable depending on the manner in which the data is generated. To identify a level of trust to have in generated data, information regarding the conditions under which data was generated may be provided along with the generated data. The added information may allow a receiver of the generated data to independently evaluate and ascribe the level of trust to have in the generated data. Different receivers of the same data may use different manners of evaluating the added information depending on their tolerance for risk in use of the generated data.
1 . A method for providing data from a data source to a data consumer that requested the data, the method comprising:
generating, by a data generator at the data source, a portion of the data;
providing, by the data generator at the data source, the portion of the data to an attestation service at the data source that attests the portion of the data, the data generator and the attestation service being operably connected via a secure interface through which the portion of the data is provided from the data generator to the attestation service;
modifying, by the attestation service, the portion of the data based on generation information that indicates condition of a system through which the portion of the data was originated to obtain a modified portion of the data, the generation information comprising at least configuration settings of a computing device making up the data source;
signing, by the attestation service, the modified portion of the data with at least one private key to obtain a signed payload, the modified portion of the data being attested by the attestation service upon signing of the modified portion of the data by the attestation service;
providing, by the attestation service, the signed payload back to the data generator via the secure interface; and
providing, by the data source, the signed payload directly to the data consumer that requested the data, the data consumer being different from the data source.
2 . The method of claim 1 , further comprising:
attempting, by the data consumer, to verify at least one signature of the signed payload to obtain a first trust indicator;
analyzing, by the data consumer, the generation information of the signed payload to obtain a second trust indicator;
ascribing, by the data consumer, a level of trust in the portion of the data from the signed payload based on the first trust indicator and the second trust indicator; and
providing, by the data consumer, computer implemented services using the portion of the data and the ascribed level of trust.
3 . The method of claim 2 , wherein modifying the portion of the data based on the generation information comprises:
updating of the portion of the data based on a reliable time source.
4 . The method of claim 3 , wherein modifying the portion of the data based on the generation information further comprises:
adding environment information regarding a user environment in which the data generated existed while the portion of the data was generated.
5 . The method of claim 4 , wherein the environment information comprises:
a hash of a boot disk image from which the data generator was instantiated;
a configuration for a host entity; and
a configuration for the data generation.
6 . The method of claim 5 , wherein modifying the portion of the data based on the generation information further comprises:
adding an attestation statement indicating that the user environment was hosted by hardware operating in a predetermined manner.
7 . The method of claim 6 , wherein the attestation statement is signed by a vendor for the hardware.
8 . The method of claim 7 , wherein signing the modified portion of the data comprises:
signing the modified portion of the data with a private key of the data generator to obtain a first signed modified portion of the data.
9 . The method of claim 8 , wherein signing the modified portion of the data further comprises:
signing the first signed modified portion of the data with a private key of a host system that comprises the hardware, the private key being secured by a trusted platform module.
10 . The method of claim 9 , wherein the trusted platform module prevents signing when the hardware is not operating in the predetermined manner.
11 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, causes the processor to perform operations for providing data from a data source to a data consumer that requested the data, the operations comprising:
generating, by a data generator at the data source, a portion of the data;
providing, by the data generator at the data source, the portion of the data to an attestation service at the data source that attests the portion of the data, the data generator and the attestation service being operably connected via a secure interface through which the portion of the data is provided from the data generator to the attestation service;
modifying, by the attestation service, the portion of the data based on generation information that indicates condition of a system through which the portion of the data was originated to obtain a modified portion of the data, the generation information comprising at least configuration settings of a computing device making up the data source;
signing, by the attestation service, the modified portion of the data with at least one private key to obtain a signed payload;
providing, by the attestation service, the signed payload back to the data generator via the secure interface; and
providing, by the data source, the signed payload to the data consumer that requested the data, the data consumer being different from the data source.
12 . The non-transitory machine-readable medium of claim 11 , wherein modifying the portion of the data based on the generation information comprises:
updating of the portion of the data based on a reliable time source.
13 . The non-transitory machine-readable medium of claim 12 , wherein modifying the portion of the data based on the generation information further comprises:
adding environment information regarding a user environment in which the data generated existed while the portion of the data was generated.
14 . The non-transitory machine-readable medium of claim 13 , wherein the environment information comprises:
a hash of a boot disk image from which the data generator was instantiated;
a configuration for a host entity; and
a configuration for the data generation.
15 . The non-transitory machine-readable medium of claim 14 , wherein modifying the portion of the data based on the generation information further comprises:
adding an attestation statement indicating that the user environment was hosted by hardware operating in a predetermined manner.
16 . The non-transitory machine-readable medium of claim 15 , wherein the attestation statement is signed by a vendor for the hardware.
17 . The non-transitory machine-readable medium of claim 16 , wherein signing the modified portion of the data comprises:
signing the modified portion of the data with a private key of the data generator to obtain a first signed modified portion of the data.
18 . A data processing system, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for providing data from a data source to a data consumer that requested the data, the operations comprising:
generating, by a data generator at the data source, a portion of the data;
providing, by the data generator at the data source, the portion of the data to an attestation service at the data source that attests the portion of the data, the data generator and the attestation service being operably connected via a secure interface through which the portion of the data is provided from the data generator to the attestation service;
modifying, by the attestation service, the portion of the data based on generation information that indicates condition of a system through which the portion of the data was originated to obtain a modified portion of the data, the generation information comprising at least configuration settings of a computing device making up the data source;
signing, by the attestation service, the modified portion of the data with at least one private key to obtain a signed payload;
providing, by the attestation service, the signed payload back to the data generator via the secure interface; and
providing, by the data source, the signed payload to the data consumer that requested the data, the data consumer being different from the data source.
19 . The method of claim 1 , wherein the secure interface is configured as a private path between the data generator and the attestation service, the private path being configured to allow transmission of data between only the data generator and the attestation service such that the attestation service knows that any data received via the private path comes directly from the data generator.
20 . The method of claim 19 , wherein
the data generator is hosted at the data source as a virtual machine or a container, and
the data source further comprises a management service that facilitates establishment of the secure interface between the data generator and the attestation service by providing the attestation service with first information that indicates whether the data generator is hosted as the virtual machine or the container and second information that indicates a computing environment of the data source in which the virtual machine or the container resides.