Secure installation of application keys
The present disclosure includes methods, devises and systems for preparing and installing one or more application keys owned by application owners in a remote device. The present disclosure further proposes methods, devices and systems for secure installation of subsequent application keys on a device utilising corresponding key derivation functions to associate an application with a respective policy and identifier using significantly low bandwidth for transfer of keys for execution of the respective application on the device.
1. A method of preparing, at a key management system, an application key owned by an application owner for installation in a remote device, the method comprising:
sending a device public key to the application owner, the device public key corresponding to a device private key stored on and specific to the remote device;
after sending the device public key to the application owner, receiving an encrypted application key for an application associated with the application owner, the encrypted application key being encrypted with the device public key; and
after receiving the encrypted application key, processing the received encrypted application key with a symmetric device key, wherein the symmetric device key is specific to and stored on the remote device.
2. The method according to claim 1 , wherein the processing comprises encrypting the encrypted application key with a symmetric device encryption key.
3. The method according to claim 1 , wherein the processing comprises adding or associating an application policy and/or identifier for the respective application to the encrypted application key.
4. The method according to claim 1 , wherein the processing comprises signing the encrypted application key with a symmetric device signature key.
5. The method according to claim 3 , further comprising sending a key seed for generating a transport key for installation of a further application key on the remote device from the application owner, wherein the key seed is generated using the application policy and/or application identifier for the respective application with a key derivation function stored at the key management system and the remote device.
6. A method of installing an application key owned by an application owner in a remote device, the method comprising:
receiving a device public key from a key management system, the device public key corresponding to a device private key stored on and specific to the device;
sending an encrypted application key associated with an application, the encrypted application key being encrypted with the device public key, to the key management system;
receiving the sent encrypted application key from the key management system, wherein the sent encrypted application key has been processed by the key management system with a symmetric device key and includes an addition of, or an association with an application policy and identifier of the respective application by the key management system, wherein the symmetric signature device key is specific to and stored on the remote device; and
sending the received processed encrypted application key to the remote device for installation.
7. The method according to claim 6 , further comprising
receiving from the key management system a key seed, wherein the key seed is generated based on an application policy associated with the application key and application identifier using a key derivation function available at the key management system and the remote device;
generating a transport key with a further key derivation function using the key seed and the application key, wherein the further key derivation function is also available at the remote device;
encrypting a further application key with the transport key; and sending the encrypted further application key to the remote device for installation.
8. A device for executing an application using one or more application keys, the device comprising:
a memory storing a private device key of a device public and private key pair and a symmetric device key;
a communication interface to receive an encrypted application key of an application; and
a processor configured to:
receive the encrypted application key,
process the received encrypted application key using the symmetric device key, and
decrypt the processed encrypted application key using the private device key.
9. The device according to claim 8 , wherein the processing comprises decrypting the encrypted application key with a symmetric device encryption key.
10. The device according to claim 8 , wherein the processing comprises decrypting an encrypted application policy and identifier with a symmetric device encryption key for enabling execution of the application on the device based on the decrypted application policy.
11. The device according to claim 8 , wherein the processing comprises verifying a signature of the encrypted application key with a symmetric device signature key.
12. The device according to claim 8 , wherein the processor is configured to
receive a further application key encrypted with a transport key;
compute the transport key using a key derivation function applied to the application key and the output of a further key derivation function, wherein the output of the further key derivation function is computed by applying the further key derivation function to an application policy and identifier associated with the application key; and
decrypt the further application key with the computed transport key.
13. The device according to claim 12 , wherein the decrypted further application key is configured to inherit the application policy associated with the received encrypted application key, for further usage.
14. The method according to claim 1 , wherein
the processing comprises encrypting the encrypted application key with a symmetric device encryption key, and also signing the encrypted application key with a symmetric device signature key, the symmetric device encryption key being different from the symmetric device signature key.
15. The method according to claim 1 , wherein
the processing comprises
encrypting the encrypted application key with a symmetric device encryption key,
adding or associating an application policy and/or identifier for the respective application to the encrypted application key, and
signing the encrypted application key with a symmetric device signature key, the symmetric device encryption key being different from the symmetric device signature key.
16. The method according to claim 1 , further comprising
sending a key seed for generating a transport key for installation of a further application key on the remote device from the application owner, wherein the key seed is generated using the application policy and/or application identifier for the respective application with a key derivation function stored at the key management system and remote device, wherein
the processing comprises
encrypting the encrypted application key with a symmetric device encryption key,
adding or associating an application policy and/or identifier for the respective application to the encrypted application key, and
signing the encrypted application key with a symmetric device signature key, the symmetric device encryption key being different from the symmetric device signature key.