Device side host integrity validation

In a computing environment, a system comprising:

• an embedded processing device that validates a host system that stores host system data, the embedded processing device including:
• a protected storage device that maintains valid hash values corresponding to the host system data;
• and
• a bootloader device that accesses computed hash values of the host system data stored on the host system and determines whether hashing of the host system data stored on the host system is performed on the host system or on another device, and on condition that the hashing is performed on the host system, determines whether the computed hash values of the host system data matches the valid hash values maintained in the protected storage device;
• and
• replace, on condition that the hash values of the host system data stored on the host system do not match the valid hash values maintained in the protected storage device, the host system data with data corresponding to the valid hash values maintained in the protected storage device, or indicate that the host system validation failed.

One or more computer storage devices having computer-executable instructions, which when executed by a computer, cause the computer to perform operations comprising:

• accessing data from a host computing system via a secure execution environment;
• selecting a set of data from the data of the host computing system;
• hashing the set of data selected into a computed hash value;
• comparing the computed hash value with one or more valid hash values of the data maintained in protected storage that is protected from access by the host computing system;
• determining whether the hashing is performed on the host computing system or on another device;
• and
• based on said determining, changing the data from the host computing system, including replacing at least one of the set of data that does not match the one or more valid hash values of the data in the protected storage with a second set of data that matches the one or more valid hash values in the protected storage, and changing a third set of data based on a relationship with the at least one of the set of data that does not match the one or more valid hash values of the data in the protected storage.