Back to results
US 10,474,454 B2Granted
System and method for updating a trusted application (TA) on a device
AssigneeOracle International Corporation
InventorNicolas Ponsini
Life of this patent
Estimating the term…
Abstract
A system and method can support device management. A trusted operating system (OS) in a trusted execution environment can store a digest for one or more binary files, which are associated with a trusted application that is deployed in the trusted execution environment. Then, the system can update the trusted application based on one or more updates received from a service provider. Furthermore, the system allows the trusted OS to derive at least one secret bound to the updated trusted application using the digest stored by the trusted OS in the trusted execution environment.
Claims20
A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
- storing a digest of a first set of one or more binary files of a first version of a trusted application, wherein the first set of one or more binary files comprises at least one of:
- (a) code of the first version of the trusted application and (b) data of the first version of the trusted application, and wherein the first version of the trusted application is deployed in a trusted execution environment;
- generating a first secret, bound to the first version of the trusted application, by applying a key derivation function to at least the digest of the first set of one or more binary files of the first version of the trusted application;
- wherein the first secret is used to encrypt information processed by the first version of the trusted application;
- updating the first version of the trusted application to provide an updated version of the trusted application based on one or more updates from a service provider, wherein the updated version of the trusted application is different than the first version of the trusted application;
- and
- generating a second secret, bound to the updated version of the trusted application, by applying the key derivation function to at least the digest of the first set of one or more binary files of the first version of the trusted application but not to any digest of a second set of one or more binary files of the updated version of the trusted application;
- wherein the second secret is used to encrypt information processed by the updated version of the trusted application.
5 more elements
A system, comprising:
- one or more microprocessors;
- a trusted execution environment running on the one or more microprocessors;
- the system being configured to perform operations comprising:
- storing a digest of a first set of one or more binary files of a first version of a trusted application, wherein the first set of one or more binary files comprises at least one of:
- (a) code of the first version of the trusted application and (b) data of the first version of the trusted application, and wherein the first version of the trusted application is deployed in a trusted execution environment;
- generating a first secret, bound to the first version of the trusted application, by applying a key derivation function to at least the digest of the first set of one or more binary files of the first version of the trusted application;
- wherein the first secret is used to encrypt information processed by the first version of the trusted application;
- updating the first version of the trusted application to provide an updated version of the trusted application based on one or more updates from a service provider, wherein the updated version of the trusted application is different than the first version of the trusted application;
- and
- generating a second secret, bound to the updated version of the trusted application, by applying the key derivation function to at least the digest of the first set of one or more binary files of the first version of the trusted application but not to any digest of a second set of one or more binary files of the updated version of the trusted application;
- wherein the second secret is used to encrypt information processed by the updated version of the trusted application.
8 more elements
A method comprising:
- storing a digest of a first set of one or more binary files of a first version of a trusted application, wherein the first set of one or more binary files comprises at least one of:
- (a) code of the first version of the trusted application and (b) data of the first version of the trusted application, and wherein the first version of the trusted application is deployed in a trusted execution environment;
- generating a first secret, bound to the first version of the trusted application, by applying a key derivation function to at least the digest of the first set of one or more binary files of the first version of the trusted application;
- wherein the first secret is used to encrypt information processed by the first version of the trusted application;
- updating the first version of the trusted application to provide an updated version of the trusted application based on one or more updates from a service provider, wherein the updated version of the trusted application is different than the first version of the trusted application;
- and
- generating a second secret, bound to the updated version of the trusted application, by applying the key derivation function to at least the digest of the first set of one or more binary files of the first version of the trusted application but not to any digest of a second set of one or more binary files of the updated version of the trusted application;
- wherein the second secret is used to encrypt information processed by the updated version of the trusted application.
5 more elements
Dependencies are inferred from the claim text.