Abstract: System and method for securing a computing device using a master cryptographic key that is bound to the device. The master key is used to derive sensitive data that is transferred to storage that is only accessible in a restricted mode of operation. The master key is used to derive one or more application keys that are used to secure data that is specific to an application/device pair. Non-privileged programs can request functions that run in a more restricted mode to use these application keys. The restricted mode program checks the integrity of the non-privileged calling program to insure that it has the authority and/or integrity to perform each requested operation. One or more device authority servers may be used to issue and manage both master and application keys.

Abstract: A method including copying a first application from a first non-volatile memory to a second non-volatile memory and setting the first application to be a start-up application. The method further includes booting-up an operating system and executing the first application. The method also includes determining if a suitable connection exists, determining if a needed bandwidth of the suitable connection is available, and downloading a second application if the suitable connection exists and the needed bandwidth of the suitable connection is available. The method then includes executing the second application. An apparatus for performing the method is also disclosed.