Device Attestation Through Security Hardened Management Agent

A computing device comprising:

• a policy store;
• a measurement system including a trusted platform module;
• a boot system configured to securely boot the computing device, the securely booting including generating and providing, to the measurement system, one or more measurements reflecting modules or components loaded on the computing device and a security state of the computing device;
• and
• a device management agent configured to run on the computing device as a hardened program that is protected from having malicious code being injected into the program, communicate via a network with an attestation service to verify the device management agent for use in an enterprise, maintain policy received from a management system via the network in the policy store, and implement the policy on the computing device.

A computing device comprising:

• one or more processors;
• and
• one or more computer-readable storage media having stored thereon multiple instructions that, when executed by the one or more processors, cause the one or more processors to perform acts including:
• securely booting the computing device, the securely booting including generating one or more measurements reflecting modules or components loaded on the computing device and a security state of the computing device;
• running a device management agent on the computing device as a hardened program that is protected from having malicious code being injected into the program;
• communicating, via a network, with an attestation service to verify the device management agent for use in an enterprise;
• and
• implementing, on the computing device by the device management agent, policy received from a management service via the network in response to the attestation service verifying the device management agent for use in the enterprise.