Device, system, and method of securely executing applications

1. A device including:

a secure-processing (SEP) hardware module including a processor capable of executing at least one SEP application,

wherein the SEP hardware module is configured to perform at least one of encrypting and decrypting data handled by the SEP application using an application-specific application-key corresponding to the SEP application, only if the processor begins execution of the SEP application at an approved entry point of the SEP application,

and wherein the application-key corresponding to the SEP application is based at least on an internal key internally stored by the SEP hardware module and on application-specific information corresponding to the SEP application,

wherein the SEP hardware module is configured to determine a plurality of application-specific descriptor values corresponding to a plurality of SEP applications based at least on application-specific information of the SEP applications, respectively; to store the descriptor values; and to determine the application-key corresponding to the SEP application based on the descriptor value corresponding to the SEP application.

2. The device of claim 1 , wherein the application-specific information includes one or more of information representing a developer public key of the creator, and information identifying the SEP application.

3. The device of claim 1 , wherein the SEP hardware module includes a memory encryption hardware module to store in a memory encrypted data, which is encrypted using an application-specific memory encryption key corresponding to the SEP application,

wherein the SEP hardware module is configured to determine the memory encryption key based at least on the application-specific information.

4. The device of claim 3 , wherein the memory encryption key is based also on a random boot value, which is determined upon boot.

5. The device of claim 1 , wherein the SEP hardware module is configured to use an inter-application key to encrypt and decrypt data communicated between first and second SEP applications, and wherein the inter-application key is based at least on the internal key, the application-specific information corresponding to the first SEP application and application-specific information corresponding to the second SEP application.

6. The device of claim 5 , wherein the SEP hardware module is to receive the application-specific information corresponding to the second SEP application from the first SEP application.

7. The device of claim 1 , wherein the SEP hardware module includes a hardware memory watcher to prevent at least write-access to at least one set of memory addresses corresponding to the at least one SEP application, respectively.

8. A method of executing at least one secure-processing (SEP) application, the method including:

only if execution of the SEP application begins at an approved entry point of the SEP application, performing at least one of encrypting and decrypting data handled by the SEP application using an application-specific application-key corresponding to the SEP application,

wherein the application-key corresponding to the SEP application is based at least on an internal key and on application-specific information corresponding to the SEP application, wherein the method further comprises:

determining a plurality of application-specific descriptor values corresponding to a plurality of SEP applications based at least on the application-specific information of the SEP applications, respectively;

storing the descriptor values; and

determining the application-key corresponding to a SEP application of the plurality of SEP applications based on the descriptor value corresponding to the SEP application.

9. The method of claim 8 including jointly performing both forcing a processor to jump to the approved entry point of the SEP application, and switching to security-context corresponding to the SEP application, wherein the security context includes information, which allows determining the application-key corresponding to the SEP application.

10. The method of claim 8 , wherein the application-specific information includes one or more of information representing a developer public key of the creator, and information identifying the SEP application.

11. The method of claim 8 comprising:

determining an application-specific memory encryption key corresponding to the SEP application based at least on the application-specific information; and

storing in a memory encrypted data, which is encrypted using the memory encryption key.

12. The method of claim 11 , wherein determining the memory encryption key includes determining the memory encryption key based also on a random boot value, which is determined upon boot.

13. The method of claim 8 comprising:

determining an inter-application key based on the internal key, the application-specific information corresponding to a SEP application and application-specific information corresponding to another SEP application; and

performing at least one of encrypting and decrypting data communicated between the SEP application and the other SEP application using the inter-application key.

14. A system including:

a memory to store at least one secure-processing (SEP) application; and

a SEP hardware module including a processor capable of executing the at least one SEP application,

wherein the SEP hardware module is configured to perform at least one of encrypting and decrypting data handled by the SEP application using an application-specific application-key corresponding to the SEP application, only if the processor begins execution of the SEP application at an approved entry point of the SEP application,

and wherein the application-key corresponding to the SEP application is based at least on an internal key internally stored by the SEP hardware module and on application-specific information corresponding to the SEP application,

wherein the secure-processing hardware module is configured to use an inter-application key to encrypt and decrypt data communicated between the first and second SEP applications, and wherein the inter-application key is based on the internal key, the application-specific information corresponding to the first SEP application and application-specific information corresponding to the second SEP application.

15. The system of claim 14 , wherein the application-specific information includes one or more of information representing a developer public key of the creator, and information identifying SEP application.

16. The system of claim 14 , wherein the secure-processing hardware module includes a memory encryption hardware module to store in a memory encrypted data, which is encrypted using an application-specific memory encryption key corresponding to the SEP application being executed,

wherein the secure-processing hardware module is configured to determine the memory encryption key based at least on the application-specific information.

17. The system of claim 16 , wherein the memory encryption key is based also on a random boot value, which is determined upon boot.

18. The system of claim 14 , wherein the secure-processing hardware module is configured to determine a plurality of application-specific descriptor values corresponding to a plurality of SEP applications based at least on the application-specific information of the SEP applications, respectively; to store the descriptor values;

and to determine the application-key corresponding to a SEP application of the plurality of SEP applications based on the descriptor value corresponding to the SEP application.

19. The system of claim 14 , wherein the SEP hardware module is to receive the application-specific information corresponding to the second SEP application from the first SEP application.

20. The system of claim 14 , wherein the SEP hardware module is configured to prevent the disclosure of the application key to the SEP application.

21. The system of claim 14 , wherein the SEP hardware module includes a hardware memory watcher to prevent at least write-access to at least one set of memory addresses corresponding to the at least one SEP application, respectively.