Application certificate

1. A method for a device, the method comprising:

determining, in dependence on at least one device permission or constraint defined for the device, whether the device is allowed to enrol a specified application installed on the device into a chain of trust provided by a public key infrastructure,

wherein in the chain of trust, a child certificate is attested as valid by an attestor associated with a parent certificate in the chain of trust, and wherein the root of the chain of trust is a root certifying authority which is external to the device; and

enrolling, when it is determined that the device is allowed to enrol the specified application into the chain of trust, the specified application into the chain of trust;

wherein the enrolling comprises generating an application certificate for verifying that the specified application is installed on the device; and

the application certificate is a descendant certificate of a device certificate of the device.

2. The method of claim 1 , wherein the application certificate is a child certificate of the device certificate.

3. The method of claim 2 , wherein the application certificate is signed with a private key for proving an identity of the device.

4. The method of claim 1 , comprising generating a private key for the specified application corresponding to a public key associated with the application certificate.

5. The method of claim 1 , wherein the specified application is enrolled into the chain of trust when the specified application is installed on the device.

6. The method of claim 5 , wherein the specified application is installed on condition that verification of the identity of the device according to the public key infrastructure is successful.

7. The method of claim 1 , comprising selecting whether or not to enrol the specified application into the chain of trust in dependence on information specified by an installation command for instructing installation of the specified application on the device.

8. The method of claim 7 , wherein the installation command specifies an enrolment flag specifying whether the application is to be enrolled into the chain of trust.

9. The method of claim 7 , wherein the installation command comprises an embedded certificate signing request having a format defined according to the public key infrastructure.

10. The method of claim 1 , wherein the device has a normal execution environment and a trusted execution environment in which at least some data or program code is accessible which is inaccessible in the normal execution environment; and

the enrolling of the specified application is performed under control of program code executing in the trusted execution environment.

11. The method of claim 1 , wherein the application certificate specifies a version identifier identifying a version of the specified application installed on the device.

12. The method of claim 1 , comprising generating a new application certificate for the specified application in response to at least one of:

updating the specified application to a new version;

changing a configuration setting for the specified application;

updating platform program code associated with a software environment in which the specified application is executed; and

changing a configuration setting for the platform program code.

13. The method of claim 12 , in which the comprising generating a new application certificate for the specified application in response to at least one of:

updating platform program code associated with a software environment in which the specified application is executed; and changing a configuration setting for the platform program code;

and in which the platform program code comprises at least one of:

system firmware of the device;

an operating system of the device;

a trusted execution environment provided on the device; and

program code for controlling or verifying updates to the program code of the specified application.

14. The method of claim 12 , comprising retaining enrolment of a previous application certificate for the specified application in the public key infrastructure after generating the new application certificate.

15. The method of claim 14 , in which the new application certificate references the previous application certificate for the specified application.

16. The method of claim 1 , comprising generating a chain of application certificates for attesting to the occurrence, or absence of occurrence, of respective events associated with the specified application.

17. The method of claim 1 , wherein said at least one device permission or constraint specifies information to be included in the generated application certificate for the specified application.

18. The method of claim 1 , comprising storing the generated application certificate in a storage location accessible to the specified application.

19. The method of claim 1 , comprising returning the generated application certificate to a requester which triggered installation or update of the specified application.

20. The method of claim 1 , wherein the device is configured to make the application certificate accessible to a verifier requesting verification of whether the specified application is installed on the device.

21. The method of claim 1 , wherein the application certificate comprises an X.509 certificate.

22. A non-transitory, computer-readable storage medium storing a computer program, which when executed, causes an electronic device to perform the method of claim 1 .

23. A device comprising:

a device memory, and

processing circuitry configured to:

determine, in dependence on at least one device permission or constraint defined for the device, whether the device is allowed to enrol a specified application installed on the device memory into a chain of trust provided by a public key infrastructure,

wherein in the chain of trust, a child certificate is attested as valid by an attestor associated with a parent certificate in the chain of trust, and wherein the root of the chain of trust is a root certifying authority which is external to the device;

enrol, when it is determined that the device is allowed to enrol the specified application into the chain of trust, the specified application into the chain of trust;

wherein enrolling of the specified application comprises generating an application certificate for verifying that the specified application is installed on the device memory; and

wherein the application certificate is a descendant certificate of a device certificate of the device.