Trust Service for a Client Device

A computer-implemented method, comprising:

• receiving an encrypted command request from a client device;
• decrypting the encrypted command request to expose a device identifier for the client device, command parameters, and a command signature, the command parameters requesting interaction with a security environment that is remote from the client device;
• generating a verification signature utilizing a device key associated with the device identifier and the command parameters;
• ascertaining whether to allow the command request based on whether the verification signature matches the command signature received with the command request;
• and
• communicating a response to the command request for receipt by the client device, the response indicating whether the command request is allowed.

A system comprising:

• one or more processors;
• and
• one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including:
• maintaining, at a trust service that is remote from a client device, a trust module for the client device that stores a device key for the client device, an indicator of a boot state of the client device, and one or more security assets for the client device;
• receiving a request from the client device to perform a trust command received as part of a command request;
• and
• ascertaining whether to allow the command request based on whether a verification signature generated using the device key and the indicator of the boot state matches a request signature received with the command request.