Local verification of code authentication

A method for authenticating code to be executed on a computing device, the method comprising:

• storing, in non-volatile storage of the computing device, a private symmetric key (PSK) unique to the computing device;
• performing, by the computing device, pre-execution local authenticity verification of externally-supplied code (ESC) in response to a command to launch the ESC on the computing device, the local authenticity verification including:
• computing a cryptographic message authentication code (MAC) of the ESC based on the PSK;
• and
• performing a verification operation to verify the MAC against a stored local authenticity verification value (LAV) previously written to the non-volatile storage;
• storing input parameters used in determining the PSK associated with the MAC, wherein access to the PSK is limited to only the verification operation, and to authorized code being executed in an isolated execution environment (IEE) of the computing device;
• and
• in response to a positive verification of the of the MAC, permitting execution of the ESC.

A non-transitory machine-readable storage medium containing instructions executable on a computing device having execution hardware including at least one hardware processor core, and non-volatile memory storing a private symmetric key (PSK) unique to the computing device, wherein the instructions, when executed, cause the execution hardware to:

• perform pre-execution local authenticity verification of externally-supplied code (ESC) in response to a command to launch the ESC on the computing device;
• wherein the local authenticity verification includes computation of a cryptographic message authentication code (MAC) of the ESC based on the PSK, and verification of the MAC against a stored local authenticity verification value (LAV) previously written to the non-volatile memory;
• store input parameters used in determining the PSK associated with the MAC, wherein access to the PSK is limited to only the verification computation, and to authorized code being executed in an isolated execution environment EE) of the computing device;
• and
• in response to a positive verification of the of the MAC, permit execution of the ESC.