Method and apparatus for secure transmission of data and applications

A method for transmitting applications and/or data from a sender to a receiver, characterized by

• in said sender, partitioning said applications and/or data into blocks,
• defining an authentication function comprising a one-way function,
• computing an authentication value for each of said blocks,
• selecting an authentication tree for said authentication values of said blocks and computing authentication values of the branches and a root authentication value of said tree,
• sequentially sending said blocks with selected ones of said block and/or branch authentication values and/or said root authentication value to said receiver,
• extracting in said receiver said application or data block,
• computing in said receiver those authentication values that are available along the branch towards the root,
• storing in said receiver authentication values needed to authenticate subsequently transmitted data blocks, and
• verifying in said receiver each subsequently received block with computed and/or stored authentication values.

Provider apparatus (AP) for downloading, updating and/or incrementing applications and/or data partioned into blocks onto a device (SC), in particular a portable device with limited processing power and/or memory, in which apparatus

• an authentication function comprising a one-way function is defined and
• an authentication tree is selected for authenticating said blocks, said apparatus including
• means (3) for computing an authentication value for each of said blocks and of the branches of said tree,
• means (4) for computing a root authentication value,
• means (5) for building messages from said blocks and selected ones of said authentication values, and
• transport means (11) for sequentially sending said messages to said receiver.

Device (SC), in particular a portable device with limited processing power and/or memory, for evaluating messages received from a provider (AP) for downloading, updating and/or incrementing applications and/or data partioned into blocks on said device, in which the provider has

• defined an authentication function comprising a one-way function and
• selected an authentication tree is for authenticating said blocks, said device including
• transport means (11) connected to said provider (AP) for receiving messages from said provider,
• means (15) for extracting said application or data block and for computing and storing authentication values are available along the branches towards the root of said authentication tree,
• means (14) for verifying signatures extracted from said blocks and for verifying each subsequently received block with computed and/or stored authentication values, and
• storage means (19) for authentication values needed to authenticate subsequently transmitted blocks.