Systems and methods for providing security to different functions

1. A circuit comprising:

a memory configured to store a server access key and a first function authentication key; and

authentication circuitry configured to:

access the server access key to authenticate access to a server to download a function capsule comprising a first function, wherein the function capsule is configured for authentication with a function capsule key and wherein the function capsule key does not also authenticate use of the first function; and

access the first function authentication key to authenticate use of the first function of the function capsule.

2. The circuit of claim 1 , where the authentication circuitry is further configured to protect against unauthorized access to the memory through a password or personal identity number.

3. The circuit of claim 1 , where the first function authentication key is configured to be remotely revoked by the server using the server access key.

4. The circuit of claim 1 , where:

the memory is further configured to store a mobile network key; and

where the authentication circuitry is further configured to:

access the mobile network key to authenticate to a mobile network.

5. The circuit of claim 4 , where the authentication circuitry is configured to authenticate to the mobile network by:

receiving a random number from the mobile network;

computing a response to the random number using the mobile network key.

6. The circuit of claim 1 , where any combination of the first function authentication key and the server access key is configured to be revoked by an updated key of the server.

7. The circuit of claim 1 , where the first function of the function capsule provides a financial service to a mobile client.

8. The circuit of claim 1 , where the memory is part of a smartcard.

9. A device comprising:

memory; and

circuitry coupled to the memory and configured to:

access a first key from the memory;

authenticate access to a server using the first key;

download, from the server, a function capsule comprising a first function, wherein the function capsule is configured for authentication with a second key;

access an additional key from the memory, the additional key configured to authenticate use of the first function but not the function capsule; and

authenticate use of the first function of the function capsule using the additional key.

10. The device of claim 9 , where the circuitry is further configured to protect against unauthorized access to the memory through a password or personal identity number.

11. The device of claim 9 , where the additional key is configured to be remotely revoked by the server.

12. The device of claim 9 , where the additional key is configured to be remotely revoked by the server using the first key.

13. The device of claim 9 , where the additional key is incapable of authenticating use of a second function of the function capsule.

14. The device of claim 9 , where the circuitry is further configured to:

receive the additional key into the memory from a key writing site.

15. The device of claim 9 , where the circuitry is further configured to:

access a security key from the memory; and

decrypt data received through a mobile network using the security key.

16. The device of claim 9 , where the first function of the function capsule comprises a payment function.

17. The device of claim 9 , where the function capsule comprises one or more keys.

18. A method comprising:

through circuitry in a mobile device:

accessing a server access key from a memory in the mobile device;

authenticating the mobile device to access a server using the server access key;

downloading, from the server, a function capsule comprising a first function, wherein the function capsule is configured for access with a function capsule key and wherein the functional capsule key does not also authenticate the first function;

accessing an additional key from the memory in the mobile device different from the function capsule key; and

authenticating the mobile device to use the first function of the function capsule using the additional key.

19. The method of claim 18 , further comprising protecting against unauthorized access to the memory in the mobile device through a password or personal identity number.

20. The method of claim 18 , further comprising:

accessing a security key from the memory; and

decrypting data received through a mobile network using the security key.