Get Rule Notice R361 Gg 37631 Form Cr1 16 May 2014 - Sars

Using hardware-backed device attestation bolsters security by providing additional verifiable, health checks. It adds a layer of protection against tampering and replay attacks by enabling signing and encryption of Intune MAM client responses.

How does TPM key attestation work? In general, TPM key attestation is based on the following pillars: Every TPM ships with a unique asymmetric key, called the Endorsement Key (EK), burned by the manufacturer. We refer to the public portion of this key as EKPub and the associated private key as EKPriv.

This attestation provides assurance that the properties of the device (for example, the serial number) are legitimate (as attested to by the device's Secure Enclave and verified by Apple's servers) and not spoofed.

Android's hardware attestation API provides a much stronger form of attestation than the Play Integrity API with the ability to whitelist the keys of alternate operating systems. It also avoids an unnecessary dependency on Google Play services and Google's Play Integrity servers.

Setting SafetyNet attestation Log into the Admin Portal. Go to Policies & Configs > Policies. Select a security policy and click Edit. Alternatively, create a new security policy by clicking Add New > Security. Scroll down to the Android section. Select “Require Google SafetyNet Attestation”.

This attestation provides assurance that the properties of the device (for example, the serial number) are legitimate (as attested to by the device's Secure Enclave and verified by Apple's servers) and not spoofed.

The SafetyNet Attestation API provides a cryptographically-signed attestation, assessing the device's integrity. In order to create the attestation, the API examines the device's software and hardware environment, looking for integrity issues, and comparing it with the reference data for approved Android devices.

At load-time, the TPM uses a hash function to fingerprint an executable, an executable plus its input data, or a sequence of such files. These hash values are used in attestation to reliably establish code identity to remote or local verifiers.