3.3. Composite Device

A composite device is an entity composed of multiple sub-entities such that its trustworthiness has to be determined by the appraisal of all these sub-entities.

Each sub-entity has at least one Attesting Environment collecting the Claims from at least one Target Environment. Then, this sub-entity generates Evidence about its trustworthiness; therefore, each sub-entity can be called an "Attester". Among all the Attesters, there may be only some that have the ability to communicate with the Verifier while others do not.

For example, a carrier-grade router consists of a chassis and multiple slots. The trustworthiness of the router depends on all its slots' trustworthiness. Each slot has an Attesting Environment, such as a TEE, collecting the Claims of its boot process, after which it generates Evidence from the Claims.

Among these slots, only a "main" slot can communicate with the Verifier while other slots cannot. However, other slots can communicate with the main slot by the links between them inside the router. The main slot collects the Evidence of other slots, produces the final Evidence of the whole router, and conveys the final Evidence to the Verifier. Therefore, the router is a composite device, each slot is an Attester, and the main slot is the lead Attester.

Another example is a multi-chassis router composed of multiple single carrier-grade routers. Multi-chassis router setups create redundancy groups that provide higher throughput by interconnecting multiple routers in these groups, which can be treated as one logical router for simpler management. A multi-chassis router setup provides a management point that connects to the Verifier. Typically, one router in the group is designated as the main router. Other routers in the multi-chassis setup are connected to the main router only via physical network links; therefore, they are managed and appraised via the main router's help. Consequently, a multi-chassis router setup is a composite device, each router is an Attester, and the main router is the lead Attester.

Figure 4 depicts the conceptual data flow for a composite device.

                  .-----------------------------.
                  |           Verifier          |
                  '-----------------------------'
                                  ^
                                  |
                                  | Evidence of
                                  | Composite Device
                                  |
.----------------------------------|-------------------------------.
| .--------------------------------|-----.      .------------.     |
| |  Collect             .---------+--.  |      |            |     |
| |  Claims   .--------->|  Attesting |<--------+ Attester B +-.   |
| |           |          |Environment |  |      '-+----------' |   |
| |  .--------+-------.  |            |<----------+ Attester C +-. |
| |  |     Target     |  |            |  |        '-+----------' | |
| |  | Environment(s) |  |            |<------------+ ...        | |
| |  |                |  '------------'  | Evidence '------------' |
| |  '----------------'                  |    of                   |
| |                                      | Attesters               |
| | lead Attester A                      | (via Internal Links or  |
| '--------------------------------------' Network Connections)    |
|                                                                  |
|                       Composite Device                           |
'------------------------------------------------------------------'

Figure 4: Composite Device

In a composite device, each Attester generates its own Evidence by its Attesting Environment(s) collecting the Claims from its Target Environment(s). The lead Attester collects Evidence from other Attesters and conveys it to a Verifier. Collection of Evidence from sub-entities may itself be a form of Claims collection that results in Evidence asserted by the lead Attester. The lead Attester generates Evidence about the layout of the whole composite device, while sub-Attesters generate Evidence about their respective (sub-)modules.

In this scenario, the trust model described in Section 7 can also be applied to an inside Verifier.

3.3. Composite Device​

3.3. Composite Device