Security Flaws and Improvements to a Direct Anonymous Attestation Scheme for Mobile Computing Platforms

The security flaws of a direct anonymous attestation scheme proposed by He et al. was analyzed, and the result shows that the authentication protocol of the scheme is vulnerable to reply attacks and platform masquerading attacks when being used for remote attestation. An improved direct anonymous attestation authentication scheme with the involvement of key agreement was proposed to provide the property of mutual authentication. The analysis shows that the authors' proposal can realize direct anonymous attestation with the properties of forgery-resistance and anonymity, and resist reply attacks and platform masquerading attacks; the scheme is effective and suitable for the mobile trusted computing platforms.