Boot security

A method for securing a device, comprising:

• receiving a first set of boot information of the device;
• receiving a first cryptographic proof of the first set of boot information, the first cryptographic proof based on at least time information of a challenge to the device;
• receiving a second set of boot information of the device, wherein the second set of boot information includes information for at least one boot item identified in the first set of boot information, and the second set of boot information corresponds to a different time than the first set of boot information;
• receiving a second cryptographic proof of the second set of boot information;
• comparing the first set of boot information and the second set of boot information;
• upon determining that the first set of boot information and the second set of boot information are different, determining whether differences between the first set of boot information and the second set of boot information are permitted as consistent with a pattern for a permitted update to the device by a hardware manufacturer;
• and
• generating an alert upon determining that differences between the first set of boot information and the second set of boot information are not permitted.

A computer program product comprising a non-transitory computer readable medium having stored thereon computer executable code that, when executing on a threat management facility, performs steps comprising:

• receive a first set of boot information from a device;
• receive a first cryptographic proof of the first set of boot information, the first cryptographic proof based on at least time information of a challenge to the device;
• receive a second set of boot information from the device, wherein the second set of boot information includes information for at least one boot item identified in the first set of boot information, and the second set of boot information corresponds to a different time than the first set of boot information;
• receive a second cryptographic proof of the second set of boot information;
• compare the first set of boot information and the second set of boot information;
• upon determining that the first set of boot information and the second set of boot information are different, determine whether differences between the first set of boot information and the second set of boot information are permitted as consistent with a pattern for a permitted update to the device by a hardware manufacturer;
• and
• generate an alert upon determining that differences between the first set of boot information and the second set of boot information are not permitted.