Patent ID: 8438658

Claim:
A method, in a data processing device, for accessing a software application, the method comprising: generating a protected execution environment comprising a portion of a local memory of the data processing device and an associated processor of the data processing device, wherein the protected execution environment is not accessible by devices external to the protected execution environment; generating a software stack within the protected execution environment, wherein the generating comprises: retrieving a core decryption key and a core authentication key, wherein the core keys are hardwired into hardware of the data processing device such that the core keys are not modifiable after being hardwired into the hardware; and decrypting a first software module using the core decryption key, wherein the first software module contains an encrypted first decryption key and an encrypted first authentication key; authenticating the first software module using the core authentication key, wherein the authenticating comprises generating an authentication value by generating hash value of the contents of the first software module using a hash function, and using the core authentication key as a key for the hash function; in response to authenticating the first software module, loading the first software module into the protected execution environment; in response to loading the first software module, decrypting the encrypted first decryption key and the encrypted key using the core decryption key, wherein the decrypting is performed within the protected execution environment; decrypting a second software module using the first decryption key, wherein the second software module contains an encrypted second decryption key and an encrypted second authentication key; authenticating the second software module using the first authentication key; in response to authenticating the second software module, loading the second software module into the protected execution environment; in response to loading the second software module, decrypting the encrypted second decryption key and an encrypted second authentication key using the first decryption key, wherein the decrypting is performed within the protected execution environment; and after loading the first and second software modules into the protected execution environment, accessing a software application using the second decryption key and the second authentication key, the software application associated with the first and second software modules.