Visible to the public Biblio

Filters: Author is O'Donoghue, Jeremy  [Clear All Filters]
2020-08-17
O'Donoghue, Jeremy.  2019.  Towards lightweight and interoperable trust models: The entity attestation token. Living in the Internet of Things (IoT 2019). :1–11.
It is generally difficult for a relying party to obtain trustworthy evidence about the characteristics of the remote systems with which they interact, and such systems as exist today tend to be proprietary and/or expensive to deploy. Large-scale IoT deployments will require mechanisms enabling the state of system components to be reliably determined to enable management systems to efficiently identify certain classes of overall system vulnerability. Such attestation mechanisms will need to support heterogeneous systems comprising equipment from many vendors, often with differing cost and security profiles. The Entity Attestation Token (EAT) [1] is an extensible and crypto-agile container for transporting claims about a device state in a verifiable manner. In its simplest form, the Entity Attestation Token can be implemented at very low cost in pure hardware, but it can scale to meet the requirements of complex systems. The Entity Attestation Token is built on the IETF COSE (CBOR Object Signing and Encryption) standard. COSE provides a lightweight, flexible and crypto-agile container for a collection of standardized claims definitions — these are being defined in number of bodies including the IETF and GlobalPlatform. Of particular practical note is the strong support for Entity Attestation Token from a number of very significant vendors in the semiconductor industry. This paper outlines the technical foundations of the Entity Attestation Token as a mechanism for reliably transporting claims within an attestation framework, discusses some of the interoperability challenges and considers areas where further work may be required.