Method for Attesting a Plurality of Data Processing Systems

Abstract

A technique for attesting a plurality of data processing systems. The method includes: configuring a chain of data processing systems wherein a first data processing system is responsible for retrieving attestation data associated with a second data processing system; sending a request for attestation of the first data processing system; in response to receiving the request, retrieving a list of associated one or more children, wherein the one or more children comprise the second data processing system; retrieving and storing attestation data associated with each child; retrieving and storing attestation data associated with the first data processing system; and sending to the requester a concatenated response containing the attestation data associated with the first and second data processing systems, such that the attestation data associated with the first and second data processing systems can be used to attest the first and second data processing systems, respectively.

1 . A method for attesting a plurality of data processing systems, comprising the steps of:
 configuring a chain of the plurality of data processing systems, wherein a first data processing system of the plurality of data processing systems is responsible for retrieving attestation data associated with a second data processing system of the plurality of data processing systems;   sending a request for attestation of the first data processing system;   in response to receiving the request, retrieving, by the first data processing system, a list of associated one or more children, wherein the one or more children comprise the second data processing system;   retrieving and storing, by the first data processing system, attestation data associated with each child of the one or more children;   retrieving and storing, by the first data processing system, attestation data associated with the first data processing system; and   sending to the requester, by the first data processing system, a concatenated response containing the attestation data associated with the first and second data processing systems, such that the attestation data associated with the first and second data processing systems is usable to attest the first and second data processing systems, respectively.   
     
     
         2 . The method of  claim 1 , wherein the chain is associated with at least one of: a physical hierarchy and a functional dependency. 
     
     
         3 . The method of  claim 1 , further comprising the step of:
 configuring the first data processing system to store data associated with one or more children of the first data processing system.   
     
     
         4 . The method of  claim 1 , wherein the attestation data comprises a Platform Control Register (PCR) and an event log. 
     
     
         5 . The method of  claim 1 , further comprising the step of:
 determining either a trusted state or an untrusted state for an associated PCR in accordance with an expected attestation value or a trusted value.   
     
     
         6 . The method of  claim 1 , wherein the first data processing system uses attestation data associated with the second data processing system to attest the second data processing system. 
     
     
         7 . The method of  claim 6 , wherein the first data processing system stores the results of the attestation in PCRs and an event log of the first data processing system. 
     
     
         8 . The method of  claim 1 , wherein a managing system uses attestation data associated at least one of: the first data processing system and the second data processing system to attest the first data processing system and second data processing system, respectively. 
     
     
         9 . The method of  claim 8 , wherein the managing system stores the results of the attestation in PCRs and an event log of the managing system. 
     
     
         10 . The method of  claim 1 , wherein the managing system stores an indication of a state associated with at least one of: the first data processing system and second data processing system. 
     
     
         11 . The method of  claim 1 , wherein data associated with the chain is maintained on a managing system. 
     
     
         12 . The method of  claim 1 , wherein each data processing system of the plurality of data processing systems represents a managed system. 
     
     
         13 . An apparatus for attesting a plurality of data processing systems, the apparatus comprising a data processor coupled to a memory that includes instructions that are operable when executed by the data processor for performing steps of:
 configuring a chain of the plurality of data processing systems, wherein a first data processing system of the plurality of data processing systems is configurable to be responsible for retrieving attestation data associated with a second data processing system of the plurality of data processing systems;   sending a request for attestation of the first data processing system;   retrieving, by the first data processing system, in response to receipt of the request, a list of associated one or more children, wherein the one or more children comprise the second data processing system;   retrieving and storing, by the first data processing system, attestation data associated with each child of the one or more children;   retrieving and storing, by the first data processing system, attestation data associated with the first data processing system; and   sending to the requester, by the first data processing system, a concatenated response containing the attestation data associated with the first and second data processing systems, such that the attestation data associated with the first and second data processing systems is usable to attest the first and second data processing systems, respectively.   
     
     
         14 . The apparatus as claimed in  claim 13 , wherein the chain is associated with at least one of: a physical hierarchy and a functional dependency. 
     
     
         15 . The apparatus as claimed in  claim 13 , wherein the instructions are further operable for performing a step of:
 configuring the first data processing system to store data associated with one or more children of the first data processing system.   
     
     
         16 . The apparatus as claimed in  claim 13 , wherein the attestation data comprises a Platform Control Register (PCR) and an event log. 
     
     
         17 . The apparatus as claimed in  claim 13 , wherein the instructions are further operable for performing a step of:
 determining either a trusted state or an untrusted state for an associated PCR in accordance with an expected attestation value or a trusted value.   
     
     
         18 . The apparatus as claimed in  claim 13 , wherein the first data processing system is configurable to use attestation data associated with the second data processing system to attest the second data processing system. 
     
     
         19 . The apparatus as claimed in  claim 18 , wherein the first data processing system is configurable to store the results of the attestation in PCRs and an event log of the first data processing system. 
     
     
         20 . The apparatus as claimed in  claim 13 , wherein a managing system is configurable to use attestation data associated at least one of: the first data processing system and the second data processing system to attest the first data processing system and second data processing system, respectively. 
     
     
         21 . The apparatus as claimed in  claim 20 , wherein the managing system is configurable to store the results of the attestation in PCRs and an event log of the managing system. 
     
     
         22 . The apparatus as claimed in  claim 20 , wherein the managing system is configurable to store an indication of a state associated with at least one of: the first data processing system and second data processing system. 
     
     
         23 . The apparatus as claimed in  claim 13 , wherein a managing system is configurable to maintain data associated with the chain. 
     
     
         24 . The apparatus as claimed in  claim 13 , wherein each data processing system of the plurality of data processing systems represents a managed system. 
     
     
         25 . A computer program product comprising computer program code stored on a computer readable storage medium to, when loaded into a computer system and executed thereon, cause said computer system to perform all the steps of a method according to  claim 1 .