Patent ID: 9674183
Date: 2017-06-06
CPC Classifications: G06F,H04L

Claim:
1. An integrity verification management method for security of communications among a local attestation service computer and a plurality of remote computer information technology (IT) machines to be identified in a trusted computing group on a computer network, comprising: requesting in an initial configuration procedure performed by the local attestation service computer, in communication with a target remote IT machine to be identified in the trusted computing group, a set of alphanumeric values defined by a user of the target remote IT machine, including hardware-specific seed values that are uniquely and unchangeably associated with specific physical hardware embodied with the target remote IT machine, generating at the local attestation service computer a unique encoded alphanumeric value (original Trust ID value) by combining the set of alphanumeric values defined by the user of the target remote IT machine, including hardware-specific seed values that are uniquely and unchangeably associated with specific physical hardware embodied with the target remote IT machine, using a Trust ID encoding algorithm; storing the locally generated encoded Trust ID value associated with the specific physical hardware for the target remote IT machine in a secure memory storage of the target remote IT machine; locally storing in the local attestation service computer the user-defined alphanumeric values associated with the target remote IT machine together with a list of types of hardware-specific seed values associated with the specific physical hardware embodied with the target remote IT machine; and performing, at the local attestation service computer locally and independently from the target remote IT machine, a local attestation procedure via a trust control application program of the attestation service computer for computing a Trust ID value by (1) requesting for retrieval from the target remote IT machine the stored original Trust ID value and the hardware-specific seed values of the stored list of types associated with specific physical hardware embodied with the target remote IT machine, and (2) combining the locally-stored user-defined alphanumeric values with the hardware-specific seed values retrieved from the target remote IT machine and encoding a comparison Trust ID value using the same Trust ID encoding algorithm that was used to encode the original encoded Trust ID value stored in the target remote IT machine; comparing at the local attestation service computer the comparison Trust ID value encoded in the local attestation procedure with the original encoded Trust ID value retrieved from the target remote IT machine, and upon a match, determining that the target remote IT machine is a trusted IT machine in the trusted computing group, or upon a failure to match, determining that the target remote IT machine is not a trusted IT machine in the trusted computing group, then taking an appropriate security action by the trust control application program of the local attestation service computer, wherein the original encoded Trust ID value is stored in the memory storage associated with the remote IT machine by a provisioning tool provided with each IT machine, and wherein based upon whether there is a match or mismatch of the recalculated comparison Trust ID value with the previously stored original encoded Trust ID value, predetermined chosen alerts and policy events are orchestrated based on the result.