# US 7,730,311 B2 · Key transformation unit for a tamper resistant module > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,730,311 B2 - Document ID: US7730311B2 - Status: Granted - Kind: B2 - Application number: 11/977,945 - Filed: 2007-10-25 - Published: 2008-03-06 - Granted: 2010-06-01 - Earliest claimed: 1997-02-21 - Assignees: Multos Limited - Inventors: David Barrington Everett; Stuart James Miller; Anthony David Peacham; Ian Stephen Simmons; Timothy Philip Richards; John Charles Viner - Web page: https://patentgrep.com/patent/US7730311B2 ## CPC - G07F 7/1016: {Devices or methods for securing the PIN and other transaction-data, e.g. by encryption (arrangements for secret communication, see H04L9/00)} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/77: in smart cards - G06K 19/0719: {at least one of the integrated circuit chips comprising an arrangement for application selection, e.g. an acceleration sensor or a set of radio buttons (application selection on smart cards using pure software control, see G07F7/10)} - G06Q 20/341: {Active cards, i.e. cards including their own processing means, e.g. including an IC or chip} - G06Q 20/355: {Personalisation of cards for use} - G06Q 20/3552: {Downloading or loading of personalisation data} - G06Q 20/3574: {Multiple applications on card} - G06Q 20/35765: {Access rights to memory zones} - G06Q 20/4097: {using mutual authentication between devices and transaction partners} - G06Q 20/40975: {using encryption therefor} - G07F 7/1008: {Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - G06F 2221/2115: Third party - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, apparati, and computer-readable media for securely transporting a software application onto a tamper resistant module (TRM) (103) by using an individualized TRM key set. A method embodiment of the present invention comprises: storing a key pair unique to the TRM (103) in a memory located on the TRM (103), where the key pair comprises a TRM public key (150) and a TRM private key (190); retrieving the TRM public key from the TRM; encrypting a portion of the software application using the TRM public key (150); transmitting the encrypted software application to the TRM (103); and recovering and decrypting the encrypted software application using the TRM private key (190). ## Claims ### Claim 1 A method for processing a data transmission, said method comprising the steps of: receiving said data transmission, said data transmission comprising an executable software application encrypted with a first key, and a key transformation unit (KTU) encrypted with a second key, wherein said executable software application comprises at least one encrypted portion having an associated location, and said KTU comprises said first key and a location indicator for said associated location; decrypting said KTU onto a tamper resistant module (TRM) to recover said first key and said location indicator; identifying said encrypted portion associated with said associated location; decrypting said encrypted portion of said executable software application onto said TRM using said first key for each encrypted portion; and storing said decrypted executable software application in memory of said TRM for subsequent execution. ### Claim 2 (depends on 1) The method of claim 1, wherein said second key is from a public key and private key set used in asymmetric encryption. ### Claim 3 (depends on 1) The method of claim 1, wherein said KTU further indicates a technique used to encrypt said portion of said executable software application. ### Claim 4 (depends on 1) The method of claim 1, further comprising the step of enciphering a second portion of said executable software application independently of said encrypted portion of said executable software application. ### Claim 5 (depends on 4) The method of claim 4, wherein said second portion is encrypted using a second encryption technique, and said KTU indicates said second encryption technique. ### Claim 6 (depends on 4) The method of claim 4, wherein said second portion is encrypted using a second key, and said KTU indicates said second key. ### Claim 7 (depends on 4) The method of claim 4, wherein said KTU comprises a second location indicator for said second portion of said executable software application. ### Claim 8 (depends on 1) The method of claim 1, wherein said KTU indicates an associated location for each portion of said executable application. ### Claim 9 (depends on 1) The method of claim 1, further comprising the steps of: providing a software application provider (SAP) with an SAP public key and an SAP private key; providing a certification authority (CA) with a CA public key and a CA private key; signing said SAP public key using said CA private key to produce an application load certificate; further encrypting said encrypted application using said SAP private key to produce a signed application; and transmitting said signed application and said application load certificate to said TRM. ### Claim 10 (depends on 9) The method of claim 9, further comprising the step of said TRM verifying said application load certificate with said CA public key. ### Claim 11 (depends on 10) The method of claim 10, further comprising the step of verifying the signed application using said SAP public key from said application load certificate to produce a verified application unit. ### Claim 12 (depends on 11) The method of claim 11, wherein said verified application unit is compared to said application unit to determine whether said verified application unit and said application unit are equivalent. ### Claim 13 Apparatus for processing a data transmission, said apparatus comprising: means for receiving said data transmission, said data transmission comprising an executable software application encrypted with a first key, and a key transformation unit (KTU) encrypted with a second key, wherein said executable software application comprises an encrypted portion having an associated location, and said KTU comprises said first key and a location indicator for said associated location; means for decrypting said KTU onto a tamper resistant module (TRM) to recover said first key and said location indicator; means for identifying said encrypted portion; means for decrypting said encrypted portion onto said TRM using said first key for said encrypted portion; and means for storing said decrypted executable software application in memory of said TRM for subsequent execution. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein said second key is from a public key and private key set used in asymmetric encryption. ### Claim 15 (depends on 13) The apparatus of claim 13, wherein said KTU further indicates a technique used to encrypt said encrypted portion. ### Claim 16 (depends on 13) The apparatus of claim 13, further comprising means for enciphering a second portion of said executable software application independently of said encrypted portion. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein said second portion is encrypted using a second encryption technique, and said KTU indicates said second encryption technique. ### Claim 18 (depends on 16) The apparatus of claim 16, wherein said second portion is encrypted using a second key, and said KTU indicates said second key. ### Claim 19 (depends on 16) The apparatus of claim 16, wherein said KTU comprises a location indicator for said second portion. ### Claim 20 (depends on 16) The apparatus of claim 16, wherein said KTU comprises a location indicator for an associated location corresponding to each portion. ### Claim 21 (depends on 16) The apparatus of claim 16, further comprising: a certification authority (CA) arrangement providing a respective CA public key; and means for verifying an application load certificate using the CA public key. ### Claim 22 (depends on 21) The apparatus of claim 21, further comprising means for providing a software application provider with an SAP public key for verifying the signed encrypted application using said SAP public key located in said verified application load certificate. ### Claim 23 (depends on 22) The apparatus of claim 22, wherein said verified application signature is compared to said encrypted application to determine whether they are equivalent. ### Claim 24 A method for processing a data transmission, said method comprising the steps of: receiving said data transmission, said data transmission comprising an executable software application encrypted with a first key, and a key transformation unit (KTU) encrypted with a second key, wherein said executable software application comprises an encrypted portion having an associated location, and said KTU comprises said first key and a location indicator for said associated location; decrypting said KTU onto a personal computer (PC) having at least one tamper resistant module (TRM) to recover said first key and said location indicator; identifying said encrypted portion; decrypting said encrypted portion of said executable software application onto a combination of PC and TRM (PC/TRM) using said first key for said encrypted portion; and storing said decrypted executable software application in memory of said PC/TRM for subsequent execution. ### Claim 25 Apparatus for processing a data transmission, said apparatus comprising: means for receiving said data transmission, said data transmission comprising an executable software application encrypted with a first key, and a key transformation unit (KTU) encrypted with a second key, wherein said executable software application comprises an encrypted portion having an associated location, and said KTU comprises said first key and a location indicator for said associated location; means for decrypting said KTU onto a personal computer (PC) having at least one tamper resistant module (TRM), a PC and TRM combination (PC/TRM) being operable to recover said first key and said location indicator; means for identifying said encrypted portion; means for decrypting said encrypted portion onto said PC/TRM using said first key for said encrypted portion; and means for storing said decrypted portion in memory of said PC/TRM for subsequent execution.