PLUGGABLE TRUSTED PLATFORM MODULE REMOTE ATTESTATION

1 . A computer system, comprising:

an interface circuit configured to communicate with an electronic device;

a processor; and

memory that stores program instructions, wherein, when executed by the processor, the program instructions cause the computer system to perform, when the electronic device comprises or does not comprise an instance of a trusted platform module (TPM) chip, operations comprising:

receiving, associated with a second electronic device, provisioning information for the electronic device;

confirming a license associated with the electronic device based at least in part on the provisioning information;

receiving, associated with the electronic device, confirmation information;

performing a join flow with the electronic device based at least in part on the confirmation information, wherein the join flow establishes a connection between the electronic device and the computer system; and

providing, addressed to the electronic device, authorization information.

2 . The computer system of claim 1 , wherein confirming the license comprising confirming that the electronic device is associated with a customer.

3 . The computer system of claim 1 , wherein the join flow comprises performing mutual authentication with the electronic device.

4 . The computer system of claim 1 , wherein the confirmation information comprises a manufacturer certificate.

5 . The computer system of claim 1 , wherein the authorization information comprises a JavaScript Object Notation (JSON) Web Token (JWT).

6 . The computer system of claim 1 , wherein the electronic device comprises the instance of the TPM chip.

7 . The computer system of claim 6 , wherein the provisioning information comprises an identifier associated with the instance of the TPM chip in the electronic device.

8 . The computer system of claim 7 , wherein the identifier comprises a serial number of the instance of the TPM chip.

9 . The computer system of claim 6 , wherein the license is associated with the instance of the TPM chip.

10 . The computer system of claim 6 , wherein, prior to performing the join flow, the operations comprise:

providing, addressed to the electronic device, an attestor identity key (AIK) certificate;

signing the AIK certificate; and

performing remote attestation with the electronic device based at least in part on the AIK certificate, wherein the remote attestation comprises TPM attestation.

11 . The computer system of claim 10 , wherein the confirmation information comprises the AIK certificate.

12 . The computer system of claim 11 , wherein the operations comprise performing verification of the electronic device based at least in part on the identifier and a result of the TPM attestation; and

wherein the authorization information is provided when the verification is successful.

13 . The computer system of claim 10 , wherein the AIK certificate is associated with a TPM verifier in the computer system, and the TPM verifier performs the TPM attestation with a TPM attestor in the electronic device.

14 . The computer system of claim 10 , wherein the AIK certificate is signed by a privacy certificate authority (CA) in the computer system.

15 . The computer system of claim 10 , wherein the operations comprise periodically performing the TPM attestation with the electronic device.

16 . A non-transitory computer-readable storage medium for use in conjunction with a computer system, the computer-readable storage medium storing program instructions, wherein, when executed by the computer system, the program instructions cause the computer system to perform, when an electronic device comprises or does not comprise an instance of a trusted platform module (TPM) chip, operations comprising:

receiving, associated with a second electronic device, provisioning information for the electronic device;

confirming a license associated with the electronic device based at least in part on the provisioning information;

receiving, associated with the electronic device, confirmation information;

performing a join flow with the electronic device based at least in part on the confirmation information, wherein the join flow establishes a connection between the electronic device and the computer system; and

providing, addressed to the electronic device, authorization information.

17 . The non-transitory computer-readable storage medium of claim 16 , wherein the electronic device comprises the instance of the TPM chip; and wherein, prior to performing the join flow, the operations comprise:

providing, addressed to the electronic device, an attestor identity key (AIK) certificate;

signing the AIK certificate; and

performing remote attestation with the electronic device based at least in part on the AIK certificate, wherein the remote attestation comprises TPM attestation.

18 . A method for performing remote attestation, comprising:

by a computer system, when an electronic device comprises or does not comprise an instance of a trusted platform module (TPM) chip:

receiving, associated with a second electronic device, provisioning information for the electronic device;

confirming a license associated with the electronic device based at least in part on the provisioning information;

receiving, associated with the electronic device, confirmation information;

performing a join flow with the electronic device based at least in part on the confirmation information, wherein the join flow establishes a connection between the electronic device and the computer system; and

providing, addressed to the electronic device, authorization information.

19 . The method of claim 18 , wherein the electronic device comprises the instance of the TPM chip; and

wherein, prior to performing the join flow, the method comprises:

providing, addressed to the electronic device, an attestor identity key (AIK) certificate;

signing the AIK certificate; and

performing the remote attestation with the electronic device based at least in part on the AIK certificate, wherein the remote attestation comprises TPM attestation.

20 . The method of claim 19 , wherein the method comprises performing verification of the electronic device based at least in part on the identifier and a result of the TPM attestation; and

wherein the authorization information is provided when the verification is successful.