Patent ID: 8627464

Claim:
One or more computer-readable storage devices comprising computer-executable instructions for evaluating a log file of a computing device, the log file comprising entries from a current generation of the computing device and at least one prior generation of the computing device, the computer-executable instructions, when executed by an evaluation computing device, cause the evaluation computing device to perform steps comprising: obtaining: the log file of the computing device, a current value of one or more Platform Configuration Registers (PCRs) of a trusted execution environment of the computing device and a current value of a monotonic counter of the trusted execution environment of the computing device; verifying incremental continuity between the current value of the monotonic counter and at least one prior value of the monotonic counter as logged in the log file, the incremental continuity being verified if a difference between the current value of the monotonic counter and the at least one prior value of the monotonic counter is not greater than a single increment value, wherein the current value of the monotonic counter is greater than the at least one prior value of the monotonic counter as logged in the log file due to the computing device having commenced the current generation subsequent to the prior generation; verifying entries in the log file corresponding to the current generation of the computing device with reference to the current value of the one or more PCRs of the trusted execution environment of the computing device; verifying entries in the log file corresponding to the at least one prior generation of the computing device with reference to prior values of the one or more PCRs of the trusted execution environment of the computing device that are logged in the log file and that correspond to the at least one prior generation of the computing device; and verifying the prior values of the one or more PCRs of the trusted execution environment of the computing device that are logged in the log file with reference to at least one quote of those prior values that is also logged in the log file.