Remote attestation of a security module's assurance level
A method by which a hardware security module can attest remotely to its measure of trust as determined by its security certifications and the Level of Assurance it can be relied on to support without the human witnessing elements that are currently used to validate this trust. In a further embodiment the Level of Assurance can be transported to a second hardware security module.
1. A method for manufacture of a hardware security module having a Level of Assurance and cryptographic software and storage within a secure boundary, which can remotely attest to its Level of Assurance, comprising the steps of:
a) creating a provisioned security module by provisioning a hardware security module to create a device attestation public key pair within the boundary of the hardware security module, said device attestation public key pair comprising a public key and a private key;
b) creating a signed certificate request by causing the cryptographic software within the provisioned security module to sign a request to a certificate authority with the private key of the device attestation public key pair, said request being for the issuance of a device attestation certificate which includes certification of the hardware security module's Level of Assurance;
c) enabling the hardware security module to transmit the signed certificate request to the certificate authority;
d) enabling the hardware security module to receive a signed device attestation certificate from the certificate authority responsive to the transmitted signed certificate request;
e) enabling the hardware security module to insert the signed device attestation certificate into the cryptographic storage;
f) enabling the hardware security module to service remote verification requests for the current ownership of the public key of the device attestation public key pair; and
g) enabling the hardware security module to service remote requests for the hardware security module's Level of Assurance by inspection of the signed device attestation certificate.