Tamper resistant module certification authority

• US 7,702,908 B2
• Filed: 10/26/2007
• Issued: 04/20/2010
• Est. Priority Date: 02/21/1997
• Status: Expired due to Fees

• Current Assignee: Multos Ltd
• Original Assignee: Multos Ltd
• Inventors: Everett, David Barrington, Richards, Timothy Philip, Miller, Stuart James, Viner, John Charles, Simmons, Ian Stephen, Peacham, Anthony David
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US11/978,034
• Publication Number:
  US 20080091958A1
• Time in Patent Office: 907 Days
• Field of Search: 713/172
• US Class Current: 713/172
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06K 19/0719 at least one of the integrated circuit chips comprising an arrangement for application selection, e.g. an acceleration sensor or a set of radio buttons application selection on smart cards using pure software control, see G07F7/10
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Methods and apparati for securely loading one or more computer software applications onto a tamper resistant module (TRM) (107) and for securely deleting one or more applications from the TRM. An embodiment of the invention comprises a method for determining, based at least upon an encrypted personalization data block, whether a TRM (107) is part of a qualified set of TRM'"'"'s to accept loading of an application. Thereafter, the method provides for loading the application onto the TRM (107) only after the first step determines that the TRM (107) is qualified to accept the loading of the application. Another embodiment comprises a method for determining, based at least upon an encrypted personalization data block, whether a TRM (107) is part of a qualified set of TRM'"'"'s to accept deleting of an application. Thereafter, the method provides for deleting the application from the TRM (107) only when the first step determines that the TRM (107) is qualified to accept the deleting of the application.

Claims

1. Apparatus comprising:

at least one tamper resistant module (TRM), a software application to be loaded onto a TRM, and means for determining whether a TRM is qualified to accept the loading of said application onto said TRM, wherein each TRM comprises TRM personalization data, and said application is assigned application permissions data representing at least one TRM upon which said application is permitted to be loaded.

2. The apparatus of claim 1, wherein said determining means compares said TRM personalization data with said application permissions data.

3. The apparatus of claim 2, wherein whether said application is loaded onto said TRM depends on the result of said comparison, such that in the event the TRM personalization data matches said permissions data set, the TRM is qualified and the application is loaded.

4. The apparatus of claim 1, wherein said personalization data comprises data representative of a unique TRM identification designation.

5. The apparatus of claim 1, wherein said personalization data comprises data representative of at least one of a TRM issuer and a product class.

6. The apparatus of claim 1, wherein said personalization data comprises data representative of a date.

7. A method for loading a software application onto a TRM, said method comprising:

determining whether said TRM is qualified to accept the loading of said application onto said TRM, wherein said determining step comprises the substeps of;

providing said TRM with personalization data;

assigning to said application permissions data representing at least one set of TRM'"'"'s upon which said application is permitted to be loaded;

comparing said personalization data with said permissions data; and

loading said application onto said TRM, provided said personalization data falls within said set of TRM'"'"'s upon which said application is permitted to be loaded.

8. The method of claim 7, wherein said personalization data comprises data representative of a TRM identification designation.

9. The method of claim 7, wherein said personalization data comprises data representative of a TRM issuer.

10. The method of claim 7, wherein said personalization data comprises data representative of a product class.

11. The method of claim 7, wherein said personalization data comprises data representative of a date.

12. The method of claim 7, comprising the step of, prior to the determining step, enabling said TRM to be loaded with said application.

13. The method of claim 12, wherein said enabling step comprises setting an enablement bit indicating that the TRM has been enabled.

14. The method of claim 12, wherein said enabling step comprises storing personalization data onto said TRM.

15. The method of claim 14, wherein said enabling step comprises setting an enablement bit indicating that the TRM has been enabled.

16. The method of claim 12, wherein, prior to said enabling step, a checking step is performed to determine whether said TRM has been enabled.

17. A method for deleting a software application from a TRM, said method comprising the steps of:

determining whether said TRM is qualified to delete said application based upon permissions data associated with said application, wherein said determining step comprises the substeps of;

providing said TRM with personalization data;

assigning to said application permissions data representing at least one set of TRM'"'"'s from which said application is permitted to be deleted;

comparing said personalization data with said permissions data; and

deleting said application from said TRM provided said personalization data falls within said set of TRM'"'"'s from which said application is permitted to be deleted.

18. The method of claim 17, wherein said personalization data comprises data representative of a TRM identification designation.

19. The method of claim 17, wherein said personalization data comprises data representative of a TRM issuer.

20. The method of claim 17, wherein said personalization data comprises data representative of a product class.

21. The method of claim 17, wherein said personalization data comprises data representative of a date.

22. Apparatus comprising:

at least one tamper resistant module (TRM);

a software application to be deleted from said TRM; and

means for determining whether a TRM is qualified to delete said application from said TRM, wherein each TRM comprises TRM personalization data, and said application is assigned application permissions data representing at least one TRM from which said application is permitted to be deleted.

23. The apparatus of claim 22, wherein said determining means makes a comparison between said TRM personalization data and said application permissions data.

24. The apparatus of claim 23, wherein whether said application is deleted from said TRM depends on the result of said comparison, such that in the event the TRM personalization data matches said application permissions data the TRM is qualified and the application is deleted.

25. Apparatus comprising:

a personal computer (PC) having at least one tamper resistant module (TRM), a software application to be loaded onto a PC and TRM combination (PC/TRM), and means for determining whether a PC/TRM is qualified to accept the loading of said application onto said PC/TRM, wherein each PC/TRM comprises PC/TRM personalization data, and said application is assigned application permissions data representing at least one PC/TRM upon which said application is permitted to be loaded.