A method for secure personalization of a chip (C) of a chipset of a cellular mobile device with an identity and credentials to install a Secure Execution Environment in the chip, the method comprising the steps: 1) at an identity and credential provider server (IPS), creating: 1.1) an image protection key (K), and 1.2) an image protection key identifier (KID); 2) masking the image protection key (K) by splitting the image protection key (K) into a first key-component (K1) and second key-component (K2); 3) providing the first key-component (K1) and the image protection key identifier (KID) to a chip manufacturer production server (CMS); 4) downloading and implementing the first key-component (K1) and the image protection key identifier (KID) from the chip manufacturer production server (CMS) to the chip (C); 5) providing the second key-component (K2) and the image protection key identifier (KID) to a device manufacturer production server (DMS) which is not accessible by the chip manufacturer production server (CMS) or / and vice-versa; 5.1) at the device manufacturer production server (DMS), retrieving, from the chip, the image protection key identifier (KID) downloaded in the chip, comparing the two key identifiers (KID), so as to identify that the second key-component (K2) belongs to the chip (C) and assigning the second key-component (K2) to the chip (C) based on the retrieved image protection key identifier (KID); 6) downloading and implementing the second key-component (K2) from the device manufacturer production server (DMS) to the chip (C); 7) in the chip (C), combining the first key-component (K1) and the second key-component (K2)and reconstructing the image protection key (K) 8) in the chip, downloading an encrypted secure operating system image and decrypting the image based on the reconstructed image protection key (K). 1) at an identity and credential provider server (IPS), creating: 1.1) an image protection key (K), and 1.2) an image protection key identifier (KID); 2) masking the image protection key (K) by splitting the image protection key (K) into a first key-component (K1) and second key-component (K2); 3) providing the first key-component (K1) and the image protection key identifier (KID) to a chip manufacturer production server (CMS); 4) downloading and implementing the first key-component (K1) and the image protection key identifier (KID) from the chip manufacturer production server (CMS) to the chip (C); 5) providing the second key-component (K2) and the image protection key identifier (KID) to a device manufacturer production server (DMS) which is not accessible by the chip manufacturer production server (CMS) or / and vice-versa; 5.1) at the device manufacturer production server (DMS), retrieving, from the chip, the image protection key identifier (KID) downloaded in the chip, comparing the two key identifiers (KID), so as to identify that the second key-component (K2) belongs to the chip (C) and assigning the second key-component (K2) to the chip (C) based on the retrieved image protection key identifier (KID); 6) downloading and implementing the second key-component (K2) from the device manufacturer production server (DMS) to the chip (C); 7) in the chip (C), combining the first key-component (K1) and the second key-component (K2)and reconstructing the image protection key (K) 8) in the chip, downloading an encrypted secure operating system image and decrypting the image based on the reconstructed image protection key (K). <EOS>