Nokia Corporation

Nokia Technologies Oy

Setec Oy

Lauri Paatero

Jan-Erik Gustav Ekberg

Nadarajah Asokan

Piotr Cofta

Antti Kiiveri

Christian Lindholm

Antti Vaha-Sipila

Matti Pärnänen

An internal but not integrated security token is provided for a device which includes a first integrated circuitry including a secure processor. The security token is provided by a second integrated circuitry separate from the first circuitry. The second integrated circuitry includes a secure non-volatile storage. The secure processor communicates information to the second circuitry in a secure manner for the secure information to be securely stored in the secure non-volatile storage, and the second integrated circuitry communicates information stored in its secure non-volatile storage to the secure processor in a secure manner. Communications is secured by means of cryptography. The first integrated circuitry and the second integrated circuitry are internal parts of the device. An initialization method for distributing a secure key to be shared between the circuitries and to be used in cryptography is also disclosed.

Implementation of an integrity-protected secure storage

A method for providing secret delegation may comprise receiving a credential secret applied to an algorithm associated with a distributed application in a trusted execution environment, causing delegation of the credential secret from one communication device to at least one other communication device, and modifying the credential secret prior to transfer of a modified version of the credential secret to the at least one other communication device in a manner that enables a generation of the credential secret to be determined. An apparatus and computer program product corresponding to the method are also provided.

Method and apparatus for providing secret delegation

The present invention relates to circuitry and a method for providing data security, which circuitry contains at least one processor and at least one storage circuit. The invention is based on the idea that circuitry is provided in which a processor is operable in at least two different modes, one first secure operating mode and one second unsecure operating mode. In the secure mode, the processor has access to security related data located in various memories located within the circuitry. The access to these security data and the processing of them need to be restricted, since an intruder with access to security data could manipulate the circuitry. When testing and/or debugging the circuitry, access to security information is not allowed. For this reason, the processor is placed in the unsecure operating mode, in which mode it is no longer given access to the protected data.

Secure execution architecture

The invention relates to a method in which program information is obtained to an execution environment in an electronic device. The program information comprises at least a program code. A key is computed of the program information and a device specific secret value. The key is used to decrypt program specific state data in the execution environment and to encrypt modified state data after the execution.

Method for the secure storing of program state data in an electronic device

The present invention relates to a method and a system for allowing multiple applications to manage their respective data in a device () having a secure environment () to which access is strictly controlled. The idea of the invention is that a storage area is allocated () within the secure environment () of a device (). The storage area is associated () with an identity of an application, the associated identity is stored () in the secure environment () and access to the storage area is controlled () by verifying correspondence between the associated identity and the identity of an accessing application. This is advantageous, since it is possible for the accessing application to read, write and modify objects, such as cryptographic keys, intermediate cryptographic calculation results and passwords, in the allocated storage area.

Key storage administration

The present invention relates to an electronic device () in which acceleration of data processing operations is provided, the device comprising a secure execution environment to which access is controlled. A basic idea of the present invention is to provide a device () for acceleration of data processing operations (an 'accelerator'). In particular, the accelerator is used to accelerate cryptographic data operations such that it performs cryptographic operations on data provided to it via a first logical interface. The cryptographic operations are performed by means of encryption/decryption keys provided to the accelerator via a secure second logical interface which may share a same physical interface () with the first logical interface or which may use a distinct physical interface () from that of a distinct physical interface () used as the first logical interface.

Practical and secure storage encryption

Methods and systems are arranged to control the decryption of an encrypted application in a device executing the application, the device arranged with a secure environment to which access is strictly controlled by a device processor. The application is divided into an installation part that establishes proper set up of the application and a protected part which is to be executed in the secure environment. An advantage with the invention is that the application provider has the freedom to control the decryption of the application software. Since it is performed in the secure environment, the owner of the device is unable to access the application and thereby copy, read or manipulate it. Moreover, the application provider handles the installation of the encrypted application and the key for decrypting the application, and is thus given the possibility to handle the encryption/decryption schemes and the key management.

Architecture for encrypted application installation

An improved system and method for safe booting an electronic device. In situations such as where a virus is infecting various devices within a network, the present invention provides an authentication centre with the ability to instruct a device on the network to safe boot. During the safe boot, it can be arranged such that no third party applications are run, only backup, restoration, or uninstallation of programs are possible, and/or only programs in the device's read-only memory are loaded. The present invention also provides a user with the ability to go through the boot process in a step-by-step manner.

System and method for safe booting electronic devices

The present invention relates to a method of, and a system for, enhancing data security, which data is to be executed in an electronic device () comprising a secure execution environment () to which access is restricted. A basic idea of the present invention is that, at device boot, data in the form of e.g. program code is copied from permanent memory () to temporary memory (). The integrity of this program code must be verified to ensure that the program code has not been altered during the transmission between the memories. Further, a new secret key is generated in the secure execution environment. This new secret key is used by a device processor () to encrypt the program code to be stored in the temporary memory in order to ensure that the program code is kept secret during transmission. The device processor thereafter writes the encrypted program code into the temporary memory.

Secure mode controlled memory

The present invention relates to a method and a system for performing testing in a device (), in which at least one program () is loaded and at least one item of mode data relating to the program is determined. Furthermore, at least one key () is generated for use in said program. In the method, at least two different security levels are determined for the keys to be used in the device (). In the method, said security level determined for the key and at least one mode data relating to the program are examined, and on the basis of the examination, it is decided if said key is available for use in the mode indicated in the mode data of the program. The invention also relates to a device, a mobile communication device and a storage medium.

Method and a system for performing testing in a device, and a device

A method and system to allow user generation of a private-public key pair and an associated user generated certificate to establish the identity of a user based upon signing the user generated certificate with a private key of a private-public key pair associated with a certificate issued by a Certification Authority (CA). The user generated certificate thereby allows the user that generated the certificate to establish a secure session with a third party without multiple use of the certificate issued by the CA, typically for use on another network infrastructure. The method and system are particularly useful for establishing a secure session, such as a Secure Socket Layer session using a personal computer, where the CA certificate is associated with a wireless identity module of a wireless device.

Method and system for user generated keys and certificates

Method, system and computer program product for implementing a trusted counter in a personal communication device. In particular, the method, system and computer program product utilizes cryptography and an external, read-write storage device that stores important state information that cannot be modified without detection. Using the present invention, the counter can be implemented in a personal even if state information is stored in an insecure storage device.

Method, system and computer program product for a trusted counter in an external security element for securing a personal communication device

The invention is a method and system for visualizing a level of trust of network communication operations and connection of servers. In a system comprising a terminal, including a display and a network, the terminal using a browser to communicate with a network during a terminal session comprising at least communication operation initiated by a user and transmitted to the network, a method of the invention includes initiating a terminal session with the browser by making a transmission to the network; the network, in response to initiation of the terminal session, provides information from the network to the browser relating to the terminal session; and displaying on the display a level of trust based upon a standard of comparison of the at least one communication operation prior to transmission to the network informing the user of a level of security determined to be associated with the at least one communication operation if the at least one communication operation is permitted by the user to be transmitted to the network.

Method and system for visualizing a level of trust of network communication operations and connection of servers

The present invention relates to a device () comprising an input for receiving an input; calculation means (P) for producing a response (OUTPUT) in response to the input (INPUT) and a secret key (A) by utilizing a first predetermined function (f), and an output () for feeding said response (OUTPUT) further. In order for an attacker not be able to find out the secret key, the device further comprises a memory (M) in which the key-specific number (RND) is stored, and means for retrieving the key-specific number (RND) from the memory (M) and for feeding it to the calculation means (P') for carrying out predetermined calculation operations (f) on the basis of the key-specific number (RND) when producing said response (OUTPUT).

Growing community of inventors

Helsinki, Finland

Lauri Paatero