Systems, methods and apparatuses for the application-specific identification of devices

1. An apparatus, comprising:

a non-volatile storage storing device specific identifier (ID) base data; and

a processor configured to:

validate a certificate of an application being executed on the apparatus, the certificate containing a code signer ID for a code signer of the application;

receive a request for a device specific unique ID of the application;

generate the device specific unique ID from the code signer ID and the device specific ID base data; and

return the generated device specific unique ID.

2. The apparatus of claim 1 , wherein the request for the device specific unique ID is received from the application and wherein the generated device specific unique ID is returned to the application.

3. The apparatus of claim 1 , wherein the device specific unique ID is generated by combining the code signer ID and device specific ID base data and calculating a one-way hash function from the combination.

4. The apparatus of claim 3 , wherein the device specific unique ID is generated by taking the code signer ID as a string, appending the device specific ID base data to the string, and calculating a hash of the resulting string.

5. The apparatus of claim 1 , wherein the non-volatile storage also stores device specific key base data and the processor is further configured to:

receive a request for a cryptographic operation from the application;

generate an encryption key from the code signer ID and the device specific key base data;

perform the requested cryptographic operation using the generated encryption key; and

return a result of the requested cryptographic operation to the application.

6. An apparatus, comprising:

a non-volatile storage storing device specific key base data; and

a processor configured to:

validate a certificate of an application being executed on the apparatus, the certificate containing a code signer identifier (ID) for a code signer of the application;

receive a request for a cryptographic operation; and

generate an encryption key from the code signer ID and the device specific key base data.

7. The apparatus of claim 6 , wherein the request for the cryptographic operation is received from the application.

8. The apparatus of claim 6 , wherein the requested cryptographic operation is to encrypt or decrypt a message using a private key.

9. The apparatus of claim 6 , wherein the requested cryptographic operation is to encrypt or decrypt a message using a symmetric key.

10. The apparatus of claim 6 , wherein the encryption key is generated by combining the code signer ID with the device specific key base data, adding a cryptographic salt, and then calculating a one-way hash of the resultant combination.

11. The apparatus of claim 10 , wherein the processor is further configured to:

determine that the generated encryption key is weak;

generate another encryption key using a different cryptographic salt if the encryption key is determined to be weak; and

determine whether the newly generated encryption key is weak.

12. The apparatus of claim 6 , wherein the processor is further configured to:

perform the requested cryptographic operation using the generated encryption key; and

return a result of the requested cryptographic operation to the application.

13. The apparatus of claim 6 , wherein the processor is further configured to return a public key of a public/private key pair to the application.

14. The apparatus of claim 6 , further comprising a key cache to store already generated encryption key(s).

15. The apparatus of claim 14 , wherein the processor is further configured to search the key cache to determine whether an encryption key needed for the requested cryptographic operation is already stored in the key cache.

16. The apparatus of claim 6 , wherein the non-volatile storage also stores device specific ID base data and the processor is further configured to:

receive a request for a device specific unique ID of the application;

generate the device specific unique ID from the code signer ID and the device specific ID base data; and

return the generated device specific unique ID to the application.

17. A computer-implemented method, comprising:

storing, in a non-volatile storage of an apparatus, device specific identifier (ID) base data;

validating a certificate of an application being executed on the apparatus, the certificate containing a code signer ID for a code signer of the application;

receiving a request for a device specific unique ID of the application;

generating the device specific unique ID from the code signer ID and the device specific ID base data; and

returning the generated device specific unique ID.

18. The computer-implemented method of claim 17 , wherein the request for the device specific unique ID is received from the application and wherein the generated device specific unique ID is returned to the application.

19. The computer-implemented method of claim 17 , wherein generating the device specific unique ID includes combining the code signer ID and device specific ID base data and calculating a one-way hash function from the combination.

20. The computer-implemented method of claim 19 , wherein generating the device specific unique ID includes taking the code signer ID as a string, appending the device specific ID base data to the string, and calculating a hash of the resulting string.

21. The computer-implemented method of claim 17 , further comprising:

storing, in the non-volatile storage, device specific key base data;

receiving a request for a cryptographic operation from the application;

generating an encryption key from the code signer ID and the device specific key base data;

performing the requested cryptographic operation using the generated encryption key; and

returning a result of the requested cryptographic operation to the application.

22. A computer-implemented method, comprising:

storing, in a non-volatile storage of an apparatus, device specific key base data;

validating a certificate of an application being executed on the apparatus, the certificate containing a code signer ID for a code signer of the application;

receiving a request for a cryptographic operation; and

generating an encryption key from the code signer ID and the device specific key base data.

23. The computer-implemented method of claim 22 , wherein the request for the cryptographic operation is received from the application.

24. The computer-implemented method of claim 22 , wherein the requested cryptographic operation is to encrypt or decrypt a message using a private key.

25. The computer-implemented method of claim 22 , wherein the requested cryptographic operation is to encrypt or decrypt a message using a symmetric key.

26. The computer-implemented method of claim 22 , wherein generating the encryption key includes combining the code signer ID with the device specific key base data, adding a cryptographic salt, and then calculating a one-way hash of the resultant combination.

27. The computer-implemented method of claim 26 , further comprising:

determining that the generated encryption key is weak;

generating another encryption key using a different cryptographic salt if the encryption key is determined to be weak; and

determining whether the newly generated encryption key is weak.

28. The computer-implemented method of claim 22 , further comprising:

performing the requested cryptographic operation using the generated encryption key; and

returning a result of the requested cryptographic operation to the application.

29. The computer-implemented method of claim 22 , further comprising returning a public key of a public/private key pair to the application.

30. The computer-implemented method of claim 22 , further comprising storing already generated encryption key(s) in a key cache of the apparatus.

31. The computer-implemented method of claim 30 , further comprising searching the key cache to determine whether an encryption key needed for the requested cryptographic operation is already stored in the key cache.

32. The computer-implemented method of claim 22 , further comprising:

storing, in the non-volatile storage, device specific ID base data;

receiving a request for a device specific unique ID of the application;

generating the unique ID from the code signer ID and the device specific ID base data; and

returning the generated device specific unique ID to the application.