A user device comprising: a memory in which a certificate repository is implemented, the certificate repository having a plurality of signed reference base state, RBS, certificates, each being associated with an application and comprising a base state that is specific to the associated application and a first hash value of a statement indicating whether an actual system state of the user device matches the base state of the associated application; a platform agent configured to receive a first command from a challenger (605; 610) to get a platform configuration computed from a starting configuration specified by the base state of the signed RBS certificate for the loaded application for which the challenger is interested in verifying the integrity; and a trusted platform module, TPM, configured to receive a second command from the platform agent to check the RBS certificate applicable to the loaded application for which the challenger is interested in verifying the integrity, and to obtain the signed RBS certificate from the certificate repository, wherein: the platform agent is further configured to construct a second hash value of a statement indicating whether a second actual system state of the user device matches the base state of the associated application contained in the RBS certificate, and issue a third command to the TPM to perform a verify-and-extend operation; and the TPM is further configured to extend a specific platform configuration register, PCR, controlled by the TPM and specific to the application that is being integrity verified for the challenger, after verifying that the first hash value of the signed RBS certificate is the same as the second hash value constructed by the platform agent, wherein the TPM is further configured to sign the PCR value with an attestation identification key and send the signed PCR value to the platform agent. a memory in which a certificate repository is implemented, the certificate repository having a plurality of signed reference base state, RBS, certificates, each being associated with an application and comprising a base state that is specific to the associated application and a first hash value of a statement indicating whether an actual system state of the user device matches the base state of the associated application; a platform agent configured to receive a first command from a challenger (605; 610) to get a platform configuration computed from a starting configuration specified by the base state of the signed RBS certificate for the loaded application for which the challenger is interested in verifying the integrity; and a trusted platform module, TPM, configured to receive a second command from the platform agent to check the RBS certificate applicable to the loaded application for which the challenger is interested in verifying the integrity, and to obtain the signed RBS certificate from the certificate repository, wherein: the platform agent is further configured to construct a second hash value of a statement indicating whether a second actual system state of the user device matches the base state of the associated application contained in the RBS certificate, and issue a third command to the TPM to perform a verify-and-extend operation; and the TPM is further configured to extend a specific platform configuration register, PCR, controlled by the TPM and specific to the application that is being integrity verified for the challenger, after verifying that the first hash value of the signed RBS certificate is the same as the second hash value constructed by the platform agent, wherein the TPM is further configured to sign the PCR value with an attestation identification key and send the signed PCR value to the platform agent. the platform agent is further configured to construct a second hash value of a statement indicating whether a second actual system state of the user device matches the base state of the associated application contained in the RBS certificate, and issue a third command to the TPM to perform a verify-and-extend operation; and the TPM is further configured to extend a specific platform configuration register, PCR, controlled by the TPM and specific to the application that is being integrity verified for the challenger, after verifying that the first hash value of the signed RBS certificate is the same as the second hash value constructed by the platform agent, wherein the TPM is further configured to sign the PCR value with an attestation identification key and send the signed PCR value to the platform agent.