A non-transitory machine-readable storage medium embodying a set of instructions for securing a device using tailored trustworthy space rules (“TTS rules”), wherein the device is configured to perform a first action and wherein the instructions, when executed by a processor in the device, cause the processor to perform operations, the operations comprising:
- obtaining a security certificate from a certificate server using an out-of-band process;
- encrypting and storing the security certificate in a certificate store on the device;
- obtaining a configuration comprising a device-wide TTS rule from a system server;
- obtaining application data comprising an application configured to perform a second action and an application-specific TTS rule from an application server;
- storing the application data in an application store on the device;
- prior to executing the application, comparing a first measurement from a sensor in the device to the device-wide TTS rule and the application-specific TTS rule;
- if the first measurement fails either the device-wide TTS rule or the application-specific TTS rule, either refraining from executing the application or preventing the application from performing the second action in accordance with the device-wide TTS rule or the application-specific TTS rule, respectively;
- during execution of the application, comparing a second measurement from the sensor to the device-wide TTS rule and the application-specific TTS rule;
- if the second measurement fails either the device-wide TTS rule or the application-specific TTS rule, either ceasing execution of the application or preventing the application from performing the second action in accordance with the device-wide TTS rule or the application-specific TTS rule, respectively;
- and
- if either the first measurement or the second measurement fails the device-wide TTS rule, preventing the device from performing the first action in accordance with the device-wide TTS rule.