Device Attestation: How GlobalPlatform Builds Trust in IoT

GlobalPlatform, built on the expertise of its members, is shaping industry through the development of standards that securely bring digital devices and services to market.

In this interview, Jeremy O’Donoghue—chair of GlobalPlatform’s Trusted Platform Services (TPS) Committee and director of engineering at Qualcomm—explains device attestation, its critical role in secure IoT, and how GlobalPlatform’s Entity Attestation API is set to elevate trust across the connected‑device ecosystem.

GlobalPlatform: Firstly, what is device attestation?

Jeremy O’Donoghue: Attestation is reliable evidence that a device is behaving as expected. In cybersecurity, it lets a relying party—such as a bank or an IoT cloud provider—confidently verify the device’s identity and integrity.

Device attestation relies on a Secure Environment—a Root of Trust (RoT)—that issues cryptographically signed attestations about a device’s state. These attestations answer questions such as whether the device booted securely, whether debugging is enabled, and whether there is evidence of tampering. Because the evidence is signed, a relying party can confirm the device’s manufacturer, identity, and untampered status before network connection.

GlobalPlatform: Why is attestation important for the success of Internet of Things (IoT) deployments?

Jeremy O’Donoghue: The IoT’s success hinges on trust in the devices that populate our networks. Attestation lets us determine whether a device is genuine, running current firmware, or compromised—information that is essential for assessing risk and ensuring network integrity.

When devices are backed by a security‑certified RoT, operators can make precise, evidence‑based assessments of each device’s trustworthiness, reducing risk and enabling reliable IoT deployments.

GlobalPlatform: Are there any interoperability challenges, and are they limiting adoption?

Jeremy O’Donoghue: Until now, trustworthy attestation has been fragmented, with proprietary metrics limiting interoperability. Standards bodies—including GlobalPlatform—are converging on a unified, interoperable framework that will allow device manufacturers and relying parties to rely on a common set of attestation proofs.

GlobalPlatform’s compliance programs and interoperability testing schemes give confidence that devices built to its standards will interoperate reliably. Moreover, the entire attestation framework is already being standardized by the IETF, and interest is growing across the industry, promising a future where a single, dependable attestation model is the norm.

GlobalPlatform: What is the value of GlobalPlatform’s Entity Attestation API?

Jeremy O’Donoghue: The Entity Attestation API builds on the IETF’s Entity Attestation Token (EAT) standard, extending it to certify tokens issued by a GlobalPlatform RoT. By defining RoT behavior and security certification—such as GlobalPlatform TEE certification or Common Criteria—this API delivers attestation that is auditable by independent laboratories, thereby substantially increasing trust in device identity and integrity.

GlobalPlatform: What are the next steps for the ecosystem?

Jeremy O’Donoghue: Next steps include finalizing the specifications, launching interoperability testing slated for 2020, and pursuing third‑party security certification of RoTs. Independent audits—whether through GlobalPlatform TEE certification or Common Criteria—will provide the critical assurance that a device’s root of trust is robust and trustworthy.

Join GlobalPlatform to help shape the Trusted Platform Services Committee’s ongoing work and drive secure, interoperable IoT standards forward.

The author is Jeremy O’Donoghue, chair of GlobalPlatform’s Trusted Platform Services (TPS) Committee and director of engineering at Qualcomm.