Architecture for encrypted application installation

A method for providing an application to be executed on a device, the device being arranged with a secure environment to which access is strictly controlled by a device processor, the method comprising:

• providing the device (201) with an encrypted application (204);
• providing, via a secure channel (207) into the secure environment (205), the device (201) with a first key for decrypting said encrypted application (204);
• encrypting, in said secure environment (205), said first key by means of a second key;
• and
• storing, outside said secure environment (205), the encrypted first key.

A system arranged to provide an application to be executed on a device, the device being arranged with a secure environment to which access is controlled by a device processor, the system comprising:

• means for providing the device (201) with an encrypted application (204);
• means for providing, via a secure channel (207) into the secure environment (205), the device (201) with a first key for decrypting said encrypted application (204);
• means for decrypting, in the secure environment (205), said encrypted application (204) by means of said first key;
• means for re-encrypting, in said secure environment, the application (209) by means of a second key;
• and
• means for storing, outside said secure environment, the re-encrypted application.

A system arranged to provide an application to be executed on a device, the device being arranged with a secure environment to which access is controlled by a device processor, the system comprising:

• means for providing the device (201) with an encrypted application (204);
• means for providing, via a secure channel (207) into the secure environment (205), the device (201) with a first key for decrypting said encrypted application (204);
• means for encrypting, in said secure environment (205), said first key by means of a second key;
• and
• means for storing, outside said secure environment (205), the encrypted first key.