Patent ID: 8261332

Claim:
A method of demonstrating to a second computing entity that a first computing entity has a trusted configuration specification, the method comprising: (a) the computing entities agreeing on a set of trusted configuration specifications, including a configuration specification of the first computing entity; (b) the first computing entity providing the second computing entity with evidence that its configuration specification is a member of the set, said evidence comprising a computed commitment, made using (but not revealing) the configuration specification of the first computing entity, and a ring signature generated using a plurality of keys, each key being generated using the commitment and one of the trusted configuration specifications, of which one key is generated using the commitment and the configuration specification of the first computing entity; and (c) the second computing entity verifying the ring signature in order to convince itself that the configuration specification of the first computing entity is in the set, wherein step (b) comprises the first computing entity: (x) digitally signing a quantity based on a secret and a said configuration specification possessed by the first computing entity, the configuration specification possessed by the first computing entity not being identifiable from said quantity; (y) forming the ring signature based on the use of one private key and multiple public keys, said private key using said secret and said public keys being formed from respective ones of the configuration specifications of said set; and (z) sending the digitally signed quantity and the ring signature to the second computing entity.