Secure element installation and provisioning

1. A method of binding a device to an authority, the method comprising:

providing an unalterable memory in the device that permanently stores information written to the unalterable memory;

reading pre-determined data corresponding to characteristics of the device;

obtaining a pseudo-random number and combining the pseudo-random number with the pre-determined data to give a base number;

downloading an application including executable code that performs at least, a cryptographic function on the base number that generates a secure identifier of the device;

storing the secure identifier in the unalterable memory of the device; and

providing, by the device, the secure identifier of the device to the authority to bind the device to the authority.

2. The method of claim 1 , further comprising:

generating a key pair on the device; and

signing the secure identifier with a first key from the key pair prior to providing the secure identifier to the authority.

3. The method of claim 2 , further comprising receiving a certificate from a certificate authority, the certificate including a second key of the key pair, wherein providing the signed secure identifier to the authority comprises providing the certificate containing the second key with the signed secure identifier.

4. The method of claim 1 , wherein the cryptographic function is a one-way hash function.

5. The method of claim 1 , wherein obtaining the pseudo-random number comprises obtaining the pseudo-random number at a hardware security module.

6. The method of claim 1 , wherein providing the unalterable memory comprises providing a fuseable link memory.

7. A device binding system comprising:

a device including:

a device memory storing attributes of the device;

an unalterable memory that stores a secure identifier of the device generated on the device; and

a processor and program memory storing executable instructions, wherein the executable instructions implement:

an algorithm that generates the secure identifier of the device on the device from selected attributes of the device and a pseudo-random number;

a routine that stores the secure identifier of the device in the unalterable memory; and

another routine that registers the secure identifier of the device with an authority;

wherein the executable instructions are received at the device as part of the process of registering the secure identifier with the authority.

8. The device binding system of claim 7 , further comprising a hardware security module that generates the pseudo-random number and stores the secure identifier.

9. The device binding system of claim 7 , further comprising:

a server at the authority that receives the secure identifier and binds the secure identifier to an entity known to the authority.

10. The device binding system of claim 7 , wherein the algorithm that generates the secure identifier implements a one-way hash function to generate the secure identifier from a combination of the selected attributes of the device and the pseudo-random number.

11. A method of binding a device to an authority, the method comprising:

generating a public key of a public-private key pair at the device;

reading selected device data available at the device;

downloading a registration application specific to a device type of the device;

executing the registration application to generate a secure identifier of the device by processing the selected device data using a cryptographic routine;

storing the secure identifier of the device in an unalterable memory on the device;

signing the secure identifier of the device with a private key of the public-private key pair; and

sending the signed secure identifier to the authority.

12. The method of claim 11 , further comprising:

sending a device-type identifier to an application service corresponding to the device type of the device;

wherein the the registration application specific to the device type is downloaded from the application service; and

wherein executing the registration application to generate the secure identifier includes using device-specific information identified by the registration application.

13. The method of claim 12 , wherein executing the registration application to generate the secure identifier comprises, creating, via the registration application, a pseudo-random number at the device that is combined with the device-specific information by the cryptographic routine to generate the secure identifier.

14. The method of claim 11 , wherein a pseudo-random number is received from another device coupled to the device via a short range network, the pseudo-random number used along with the selected device data by the cryptographic routine to generate the secure identifier.

15. The method of claim 11 , further comprising:

requesting registration of a public key of the public-private key pair at a certificate authority; and

receiving, at the device from the certificate authority, a certificate that includes the public key, wherein sending the signed secure identifier to the authority includes sending the certificate and the signed secure identifier to the authority.

16. The method of claim 11 , wherein storing the secure identifier in the unalterable memory comprises writing the secure identifier to the unalterable memory and executing a command that prevents the secure identifier from being modified.