Application integrity attestation

A device, comprising:

• a secure circuit;
• a processor;
• and
• memory having program instructions stored therein that are executable by the processor to cause the device to perform operations including:
• performing, by an application executing on the device, an enrollment process of the application in which the secure circuit is configured to generate a signature key for the application to generate a subsequent attestation, wherein the enrollment includes the application receiving a certificate associated with the signature key and usable to verify attestations;
• sending, by the executing application executing on the device, a request for an attestation indicating that the executing application has been verified;
• receiving, by the executing application, the requested attestation from the secure circuit, wherein the secure circuit is configured to provide the requested attestation based on a verification of the integrity of the executing application, wherein the verification includes performing a comparison of a signed hash value and a hash value generated from the executing application in response to the sent request;
• and using the received attestation to perform an action.

A method, comprising:

• performing, by an application executing on a device, an enrollment in which a secure circuit included in the device generates a public key pair for the application to generate a subsequent attestation, wherein the enrollment includes the application receiving a public key of the public key pair and usable to verify attestations;
• sending, by the executing application executing on a device, a request for an attestation indicating that the executing application has been verified;
• receiving, by the executing application, the requested attestation from a secure circuit included in the device, wherein the secure circuit is configured to provide the requested attestation based on a verification of the integrity of the executing application, wherein the verification includes performing a comparison of a signed hash value and a hash value generated from the executing application in response to the sent request;
• and
• using the received attestation to perform an action.