Over-the-air-provisioning of application library

A portable communication device comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions, which when executed by the processor, cause the portable communication device to perform operations including:
• determining that an update for a private portion of a mobile application installed on the portable communication device is available at a server;
• sending a request for the update to the server, the request including a current private portion identifier associated with a current version of the private portion installed on the portable communication device, wherein the current private portion identifier and a current transport key are embedded in the current version of the private portion installed on the portable communication device;
• receiving an updated version of the private portion from the server that is encrypted using the current transport key;
• decrypting the updated version of the private portion using the current transport key embedded in the current version of the private portion installed on the portable communication device, wherein an updated transport key and an updated private portion identifier are embedded in the updated version of the private portion, and wherein the updated private portion identifier is associated with the updated version of the private portion;
• installing the updated version of the private portion without updating a public portion of the mobile application;
• subsequent to installing the updated private portion:
• sending a request to the server for sensitive data, the request including the updated private portion identifier associated with the updated version of the private portion;
• receiving the sensitive data encrypted using the updated transport key embedded in the updated version of the private portion;
• and
• decrypting the sensitive data using the updated transport key, wherein decrypting the sensitive data using the updated transport key comprises:
• generating a derived key using the updated transport key and a key derivation seed received from the server;
• and
• decrypting the sensitive data with the derived key.

A server for providing an update to a mobile application installed on a portable communication device, wherein the mobile application includes a public portion and a private portion, the server comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions, which when executed by the processor, cause the server to perform operations including:
• receiving a request for an update to the private portion of the mobile application from the portable communication device, the request including a current private portion identifier associated with a current version of the private portion installed on the portable communication device, wherein the current private portion identifier and a current transport key are embedded in the current version of the private portion installed on the portable communication device;
• determining, based on the current private portion identifier, the current transport key;
• encrypting an updated version of the private portion using the current transport key, wherein an updated transport key and an updated private portion identifier are embedded in the updated version of the private portion, and wherein the updated private portion identifier is associated with the updated version of the private portion;
• transmitting the encrypted updated version of the private portion to the portable communication device without transmitting an update to the public portion of the mobile application, wherein the portable communication device thereafter installs the updated version of the private portion;
• receiving a request for sensitive data, the request including the updated private portion identifier associated with the updated version of the private portion;
• encrypting the sensitive data using the updated transport key embedded in the updated version of the private portion, wherein the operation of encrypting the sensitive data using the updated transport key comprises:
• generating a derived key using the updated transport key and a seed;
• and
• encrypting the sensitive data with the derived key;
• transmitting the encrypted sensitive data to the portable communication device.