Method and system for confidentially executing a program in a confidential environment

Abstract

The invention relates to a method for protecting a program (500) by confidentially executing the program (500) in a confidential environment (210) of a processor unit (200) of a computer (400) or server (600), comprising the following steps: providing a processor unit (200) having a confidential environment (210) and having at least one confidential core (222), which is a secure core (220) in the confidential environment (210); providing an encrypted program (500) which is to be executed in the confidential environment (210); providing an external secure element (300) which can be connected to the computer (400) and which comprises a cryptographic key (530) for decrypting the encrypted program (500); connecting the external secure element (300) to the computer (400); transmitting the cryptographic key (530) from the external secure element (300) to the processor unit (200) in encrypted form (540); decrypting the encrypted program (500) using the cryptographic key (530); executing the decrypted program (500) within the confidential environment (210) of the processor unit (200).

Description

[0001] April 13, 2026 P Dateuntarnwmälte

[0002] WIBU-Systems AG

[0003] Method and system for the confidential execution of a program in a confidential environment

[0004] The present invention relates to a method for protecting a program with the aim of confidentially executing the program in a confidential environment of a GPU of a server, wherein a GPU with a trust anchor is provided.

[0005] The field of artificial intelligence and machine learning has experienced rapid growth, with processors or processing units (PUs, or central processing units, CPUs), and especially graphics processing units (GPUs), becoming essential for running complex computational models. GPUs offer parallel processing capabilities that enable the efficient execution of AI models, including deep learning networks, image recognition systems, and natural language processing applications. These models often represent significant investments in the intellectual property of their developers and require protection against unauthorized access or copying.

[0006] Confidential data processing has emerged as a technological approach to protecting sensitive data and computations in cloud environments. Traditional confidential data processing solutions primarily focus on protecting end-user data during processing in data center environments. These solutions typically use hardware-based security mechanisms to create isolated execution environments where sensitive computations are performed.

[0007] Page 1 of 48. April 13, 2026

[0008] can be protected from unauthorized parties, including cloud service providers and system administrators.

[0009] Current GPU protection mechanisms face several limitations when applied to proprietary AI models and kernels. Existing approaches for sensitive data processing are primarily designed for large-scale data centers and public cloud providers, with limited support for on-premises deployment scenarios. These solutions often require centralized infrastructure and continuous network connectivity, making them unsuitable for local environments where users may need to work offline or under isolated network conditions.

[0010] Licensing AI models presents additional challenges in current systems. Traditional approaches tie licensing mechanisms to specific cloud platforms or centralized services, limiting the flexibility of model deployment across different computing environments. This creates dependencies on external infrastructure and prevents owners of AI models or other models from offering their property in various deployment scenarios, including local, on-premises installations.

[0011] For example, US 2020 / 0019697 A1 discloses a platform for executing protected AI models, which is characterized in particular by the fact that the client application is tightly integrated with a specific platform environment. A trust anchor, specifically a TPM, is an integral part of the hardware- and software-specific platform environment, on which the execution of usage rights to AI models is controlled. An external rights management system, which is integrated with the platform environment in the same specific way as the client application, is required as a systemic component for rights management.

[0012] Page 2 of 48. April 13, 2026

[0013] US patent 2012 / 0237023 A1 discloses a secure element or token for the secure management of cryptographic keys, in particular through so-called key wrapping with a "key encrypting key". The focus is on the secure storage, encryption, and controlled release of keys, independent of the specific execution environment of a program.

[0014] Document XP61079886A describes confidential execution or computing within specialized AI accelerators, where models and data are protected by hardware isolation during execution. The document focuses on accelerator-internal security mechanisms, attestation, and protection against operator interference and system attacks, but without independent or external license or key management.

[0015] Existing security solutions also lack the capability to provide independent license verification that operates separately from the execution environment. Current systems typically require trust in platform providers or centralized authorities, which may not align with the security requirements of organizations that want to protect their proprietary algorithms and data processing methods.

[0016] In established systems for the confidential execution of programs or models, security mechanisms are typically implemented within the respective execution platform, for example, in the form of Trusted Execution Environments, platform-integrated trust anchors, or comparable hardware-based security components within the processor unit. In such architectures, control over security-relevant functions, including potential license checks or key provisioning, is regularly performed within the platform itself.

[0017] Page 3 of 48. April 13, 2026

[0018] As a result, the licensing logic is often functionally coupled to the respective hardware or cloud platform. Changing the execution platform or using different platforms may necessitate additional adjustments or new licensing mechanisms in such cases. Furthermore, control over the release of cryptographic keys typically remains within the platform itself, meaning that an independently controlled licensing instance is usually not provided, or can only be operated with the involvement of central infrastructure.

[0019] In particular, a solution is lacking that allows license verification and the release of cryptographic keys to be carried out independently of the respective execution platform.

[0020] The current state of technology presents the problem that improved protection is desired when processing sensitive programs or data on computers or servers with processors.

[0021] The problem is solved by a method having the features of claim 1 and by a system having the features of claim 14.

[0022] The first aspect describes a method for protecting a program with the aim of confidentially executing the program in a confidential environment, such as a Trusted Execution Environment (TEE), a processing unit (PU) of a computer or server. The method comprises: providing a processing unit (PU) with a secure TEE and at least one trusted execution core (TEC) that is a core within the confidential environment (TEE); providing an encrypted program to be executed in the confidential TEE environment; providing an external secure element (ESE) that can be connected to the computer and that includes a cryptographic key for decrypting the encrypted program and license data; connecting the external secure element to the computer; and performing a license check for the cryptographic key.

[0023] Page 4 of 48. April 13, 2026

[0024] Key generation based on the license data; transfer of the cryptographic key from the external secure element to the processor unit (preferably to the protected core (TEC) of the processor unit); decryption of the encrypted program using the cryptographic key; and execution of the decrypted program within the trusted execution environment (TEE) of the processor unit.

[0025] In a further aspect, the present invention relates to a system for protecting a program with the aim of confidentially executing the program in a confidential environment of a processor unit. The system comprises the processor unit with a confidential environment and with at least one confidential kernel, which is a core within the confidential environment. The system includes an external secure element that is connectable to a computer, preferably releasably. The system is designed and configured to establish a secure connection between the external secure element and the processor unit. It is further configured for the confidential transmission of a program, preferably encrypted, a model or kernel, or other data to the confidential kernel using the secure connection.The system is further configured to transfer a cryptographic key to the confidential core from the external secure element. Preferably, the cryptographic key is stored in the external secure element.

[0026] The transfer of the cryptographic key to the confidential kernel preferably occurs after a successful license check based on license data that preferably reflects the authorization to execute the program, model, or kernel, or to transfer the cryptographic key. The system's secure element is configured to perform a license check of the cryptographic key's use based on stored license data, and the secure element is not part of the confidential environment and / or the processor unit.

[0027] Page 5 of 48. April 13, 2026

[0028] The system can then decrypt the program, model, or kernel using the cryptographic key in the confidential core and execute the decrypted program, model, or kernel within the confidential environment of the processor unit. Execution and decryption occur without any external third party being able to view the confidential environment and the confidential core of the processor unit or influence the execution or encryption.

[0029] In a further aspect, the present invention relates to an external secure element for storing a cryptographic key, suitable for a system as described above. The external secure element is characterized in that it is configured to encrypt the cryptographic key with a received encryption key and to make the encrypted cryptographic key available for transmission to the confidential core of the processor unit. Preferably, the external secure element can include license data and can perform a license check, preferably based on the stored license data. Transmission of the cryptographic keys preferably only occurs after successful license verification. Preferably, the license decision or the determination of a successful license check takes place within the secure element and is initiated by it.

[0030] This ensures a clear separation between the execution instance of the program, model or kernel and the license instance for verifying a license in the external secure element.

[0031] License verification takes place in the external secure element, which is not part of the processor unit or the confidential environment, while the execution of the protected program, model, or kernel occurs in the protected or confidential environment of the processor unit. Thus, there is a clear separation between license verification and program execution, with this separation encompassing at least a functional, logical, and / or physical separation, meaning it is divided into two distinct components.

[0032] Page 6 of 48. April 13, 2026

[0033] The concept according to the invention thus differs significantly from the prior art and pursues a technologically contrasting approach. This approach represents a paradigm shift compared to known protection systems.

[0034] In a further aspect, the present invention relates to a processor unit with a confidential environment and with at least one confidential core, which comprises a core within the confidential environment. The confidential core and / or the confidential environment may include a trust anchor, which is embedded in the core or the environment during the manufacture of the processor unit, is immutable, and serves to identify or authenticate the core or the environment.

[0035] Preferably, the confidential core or environment, or a trust anchor embedded in the confidential core, includes proprietary programs, models or AI models, cores, or cryptographic keys that are pre-loaded and / or implemented by the processor unit manufacturer, so that the manufacturer can directly control the license terms for the programs, models, cores, or cryptographic keys.

[0036] This method enables the secure execution of models, including proprietary AI models, and / or kernels or GPU kernels, both on local computers and in cloud or other server environments, while simultaneously protecting the program, model, and / or kernel, and thus the ownership rights of the model owners. Unauthorized manipulation or execution of the program, model, and / or kernel is reliably prevented. Furthermore, the separation between the external secure element and the processing unit (PU), CPU, or GPU as the execution environment provides independent license verification that does not rely on centralized infrastructure.

[0037] Page 7 of 48. April 13, 2026

[0038] The process begins with the provision of the necessary components and the establishment of a preferably secure connection between them. This secure connection can be an encrypted connection.

[0039] Furthermore, an encrypted program or data is provided for execution in the confidential environment. It is transferred to the confidential environment of the processor unit. The transfer to the confidential and usually highly secured area (environment) can also be encrypted. However, special security for the connection is not necessary, especially if the program is transferred from a storage unit to the processor within a computer.

[0040] The cryptographic key for decrypting the program, model, kernel, or data is transmitted by the external secure element to the processor or processor unit, the secure kernel (TEC), or the confidential secure environment (TEE), preferably at a later time, only after successful license verification by the external secure element. This transmission occurs independently of the program transmission. Only after decryption can the program or model be executed in the confidential environment of the processor unit without unauthorized third parties gaining access to the protected model, the kernel, the data contained therein, or the intellectual property contained therein.

[0041] Advantages include increased security due to the storage of the cryptographic key in the external secure element, making it independent and separate from the computer or processor unit. Further advantages include flexibility in deployment across various environments, independence from central infrastructure, and the ability to run offline. Security can be further enhanced by using a hardware-based trust anchor. The process is correspondingly flexible.

[0042] Page 8 of 48. April 13, 2026

[0043] Typical application scenarios of the method according to the invention include the protection of proprietary AI models in medical applications where sensitive patient data is processed, the secure execution of financial models in regulated environments, use in industrial control systems with high security requirements, and the provision of AI services in edge computing scenarios without a permanent network connection.

[0044] The external secure element is not part of a TPM (Trusted Platform Module) or an HSM (Hardware Security Module). It is neither part of a confidential core, processor unit, CPU, GPU, or confidential environment, nor is it integrated into any of these elements. The secure element is preferably logically, functionally, and / or physically separate from the aforementioned elements.

[0045] In a preferred embodiment, the program includes one or more models or AI models, kernels or GPU kernels, or sensitive data, for example for such models.

[0046] In a preferred embodiment of the method, the transmission between the external secure element and the processor unit can be based on a secure connection, and the establishment of the secure connection is based on encryption keys, preferably certified keys, and particularly preferably keys that are provided in both instances (the user's computer and the secure element and / or the processor unit of the executing computer or server). This offers the advantage of increased security through mutual authentication, which can effectively prevent man-in-the-middle attacks, for example, in the case of a processor unit in an external server.

[0047] The use of certified keys provided in both instances ensures strong cryptographic authentication between the confidential environment of the PU or GPU and the external secure element.

[0048] Page 9 of 48. April 13, 2026

[0049] This reduces the risk of attacks and ensures the integrity of the secure connection. An additional advantage is that no central certification authority is required for ongoing communication, which increases system independence.

[0050] In a preferred embodiment of the method, further steps include securing the cryptographic key using backup data. A further step preferably involves transmitting the secured cryptographic key to the external secure element. Another step involves making the backup data available to the external secure element. In a subsequent step, the secured cryptographic keys are decrypted by the external secure element as needed, with the backup data preferably being based on license data or license information from a program rights holder. This has the advantage that authorization can be verified using license data or license information before transmitting the cryptographic key to the confidential kernel or processor unit. Transmission only occurs after successful license verification.The backup data, which may contain one or more license keys or license information, is provided by the rights holder and is typically stored in the external secure element. The confidential core sends a request to the external secure element to transmit the key based on the license agreement contained within the external secure element.

[0051] Unlocking the secured cryptographic key can include decrypting the cryptographic key. The cryptographic key is then transmitted from the secure element to the confidential core, whereby the transmission can take place via a secure transmission channel or encrypted, for example, with a public key of the confidential core. Unlocking the secured cryptographic key takes place at least partially, preferably exclusively, within the secure element.

[0052] Page 10 of 48. April 13, 2026

[0053] In this way, it is possible to secure the cryptographic keys in the external secure element, preventing their unexploitation. Unlocking or decrypting is only possible with the backup data, which can also be stored in the secure element. Within the secure element, cryptographic keys and backup data can be kept separate. The terms "secure" and "unsecure" are therefore synonymous with "encrypt" and "decrypt" using the backup data.

[0054] In the preferred embodiment, the cryptographic key is transferred to the confidential core after a license check performed by the external secure element. This license check can, as described above, be based on the license data or license information provided by the rights holder.

[0055] In a preferred embodiment of the method, key material for encrypting and decrypting user data, licenses, license data, or other data for license verification by the external secure element can be provided. Preferably, the key material can also include the cryptographic key itself. Furthermore, the key material can include other encryption keys, such as keys from an asymmetric key pair.

[0056] Preferably, the licensing and / or protection of a program, model, or kernel is carried out independently of central structures and regardless of whether it is executed in a local environment or in a public cloud and / or regardless of public infrastructure. This enables offline or standalone execution.

[0057] The preferred method is designed such that the execution of an encrypted program can take place on a standalone computer, as long as the cryptographic key is present in an external secure element that can be connected to the computer. In this way

[0058] Page 11 of 48. April 13, 2026

[0059] Is it possible to execute a program in a protected manner without relying on third parties?

[0060] In a preferred embodiment, the method can include further steps and be configured to also use a processor unit in an external server that is separate from the computer, preferably physically separate. The processor unit used to execute the protected and encrypted program is part of a server, preferably located in the cloud. The external secure element is connected to the computer and can initiate the execution of the program. In a further step, the computer transmits the encrypted program to the server. This is preferably done via a secure connection, for example, a TLS connection. Once the encrypted program has been transmitted from the computer to the server, or is already present there, the computer can initiate the execution of the program in the confidential core of the server's processor unit.The confidential core can be part of the server's CPU or GPU. This allows for higher computing capacity or greater parallelization within a single server computer.

[0061] In a further preferred embodiment of the method, an additional step comprises initiating a decryption process of the program, model, or kernel, preferably by a user of the computer or by the computer itself. A further step comprises providing an encryption key pair consisting of a public encryption key and a private encryption key. Preferably, the encryption key pair is provided in the confidential kernel or in a trust anchor within the confidential kernel. In this way, the confidential kernel has access to both keys of the key pair.

[0062] Page 12 of 48. April 13, 2026

[0063] A further step preferably involves requesting the public encryption key of the processor unit. Preferably, a certified public encryption key is requested, which is most preferably stored in a trust anchor.

[0064] Optionally, a nonce, i.e., a number-used-only nonce, can also be used here. After the request and an optional corresponding verification, the public encryption key and the optional nonce are transmitted from the processor unit to the external secure element.

[0065] A further step involves determining the presence of the optional nonce and validating the public encryption key, preferably against a trusted root certificate. This preferably takes place in the external secure element. In a subsequent step, the cryptographic key, which is preferably unencrypted at this point, is encrypted with the public encryption key of the processor unit. A further step involves transmitting the encrypted cryptographic key and, optionally, further license information from the external secure element to the processor unit.

[0066] A further preferred step involves receiving and decrypting the encrypted cryptographic key in the processor unit. This preferably takes place in the confidential core of the processor unit, and particularly preferably in a trust anchor of the processor unit or the confidential core. The encrypted cryptographic key is decrypted using the private encryption key of the public key. The private encryption key is the corresponding part of the encryption key pair.

[0067] In this way, a secure transfer of the cryptographic key for decrypting the program between the external device is possible.

[0068] Page 13 of 48. April 13, 2026

[0069] The secure element and the processing unit or processor unit are involved. This is particularly important when the processor unit is used on an external server.

[0070] Another preferred embodiment of the method provides that, in addition to the cryptographic key, license information for the program, model, or kernel is also made available to the external secure element. This allows for the centralized storage, processing, and handling of the cryptographic key within the external secure element.

[0071] The method can also preferably include the use of certified encryption keys stored in two locations: preferably on the processor unit (such as CPU or GPU), preferably in a trust anchor, and on the external secure element and / or the computer, preferably only the public key of the encryption key pair. An additional advantage is increased fault tolerance, as the keys are stored redundantly, thus ensuring authentication even in the event of partial system failure.

[0072] This bidirectional key storage creates mutual authentication between the components, allowing the confidential core, the processor unit's confidential environment, and the external secure element to verify their respective identities before sensitive operations are performed. In the case of the confidential core or environment, this can be achieved using a trust anchor. An additional benefit is the prevention of spoofing attacks, where an attacker attempts to impersonate a legitimate component.

[0073] The method may further include transferring a model, a computer model, or a kernel from the computer or external secure element to the GPU, with the program, model, or kernel being encrypted. An additional

[0074] Page 14 of 48. April 13, 2026

[0075] A particular advantage lies in the ability to flexibly employ different encryption algorithms depending on security requirements and computing power. These include, among others, classical (e.g., ECDSA, ECIES), quantum-safe (e.g., ML-KEM, ML-DSA), or composite (i.e., a combination of classical and quantum-safe methods, e.g., ML-KEM+ECIES, ML-DSA+ECDSA) cryptographic methods.

[0076] According to a further preferred embodiment of the method, the cryptographic key is provided to the secure element. Additionally, license information for the program, model, and / or kernel can be provided.

[0077] In this implementation, the cryptographic key is transferred to the processor unit after a license check by the external secure element. This allows for the implementation of various licensing models, such as time-based, usage-based, or function-based licenses, without modifying the core or processor architecture.

[0078] In a preferred embodiment, the confidential core of the processor unit can include a trust anchor associated with or linked to a UID certificate. The UID certificate is a unique trust certificate used to ensure the authenticity and immutability of the trust anchor. The UID certificate can be issued by a CA or other certified body. It can be time-limited.

[0079] License verification prior to key transfer enables precise control over program or model usage and ensures that only authorized users with valid licenses gain access to the proprietary models, thus facilitating effective monetization and rights management. An additional benefit is the ability to collect usage statistics without disclosing sensitive model data.

[0080] Page 15 of 48. April 13, 2026

[0081] Preferably, key material for encrypting and decrypting user data or other data is provided by the external secure element. One advantage is the clear separation of responsibilities, which implements the principle of least privilege and reduces the risk of insider attacks. Providing key material for user data through the external secure element extends protection beyond the models to the processed data itself, ensuring end-to-end confidentiality and protecting sensitive information from unauthorized access.

[0082] The process can also include licensing the model and / or kernel and / or protection independently of central structures and regardless of whether it is run in a local environment or in a public cloud. One advantage is improved resilience against denial-of-service attacks on central licensing servers.

[0083] This independence from central structures enables flexible deployment of AI models or models in different environments without requiring a continuous connection to centralized license servers, thereby increasing system reliability. An additional advantage is the ability to operate in environments with strict data localization requirements without external dependencies.

[0084] Offline execution of the procedure enables its use in critical infrastructures or emergency scenarios where network connections may be unreliable or unavailable. This offline capability extends the system's applicability to isolated or safety-critical environments where network connections may be unavailable or undesirable, thereby increasing the solution's versatility and security.

[0085] Page 16 of 48. April 13, 2026

[0086] In a preferred embodiment of the method, a secure connection is established between the external secure element and the confidential core and / or the trust anchor. This makes it possible to implement advanced cryptographic protocols such as post-quantum cryptography to address future security threats.

[0087] Establishing a direct, secure connection between the external secure element and the confidential core and / or trust anchor minimizes the attack surface by bypassing intermediate components. Secure end-to-end communication for critical security operations is ensured. Latency is reduced for security-critical operations by eliminating intermediate communication steps.

[0088] In a preferred embodiment of the method, a protocol for communication between the external secure element and the confidential core is preferably used with or without a nonce. A nonce enhances the security of the communication, being embedded in each communication session between the trust anchor and the external secure element to ensure the uniqueness of each message. For example, a new 128-bit random number can be generated and incorporated into the message with each authentication request, ensuring that even identical requests produce different cryptographic signatures. A significant advantage of using a nonce is the effective protection against replay attacks, in which an attacker could resend previously intercepted messages to gain unauthorized access.

[0089] Connectable and connected to a computer in this context means that a communication link exists such that data can be exchanged between the two components.

[0090] This system offers an integrated hardware and software solution for the protection of models, preferably proprietary AI models, enabling seamless operation.

[0091] Page 17 of 48. April 13, 2026

[0092] Deployment in various computing environments is enabled, while simultaneously offering strong security guarantees through the combination of Trusted Execution Core (TEC), Trust Anchor and external Secure Element.

[0093] The Trust Anchor serves as a hardware-based trust anchor within the GPU, enabling authenticated cryptographic operations to be performed in an isolated environment within the confidential environment or Trusted Execution Core. Meanwhile, the external Secure Element acts as an independent trusted authority for license validation and key management. Communication between these components preferably occurs via encrypted channels with mutual authentication, thus implementing a multi-layered security concept. A particular advantage of this system is its ability to be flexibly adapted to different deployment scenarios, whether in local environments, edge computing applications, or cloud infrastructures, without compromising security.

[0094] Furthermore, license management and license validation / verification are independent of the processor unit and its architecture. If the processor unit is changed to a different manufacturer, the license management within the Secure Element can be transferred and adapted to current security standards and procedures, regardless of the architecture.

[0095] Preferably, the system's trust anchor is a hardware-based trust anchor embedded in the processor unit, CPU, or GPU. The trust anchor is preferably implemented as a physical hardware component within the GPU architecture, serving as the root of trust. A significant advantage of this implementation is the increased security provided by physical isolation, which considerably hinders manipulation attempts.

[0096] Page 18 of 48. April 13, 2026

[0097] The hardware-based implementation of the Trust Anchor provides a tamper-proof trust anchor that is resistant to software-based attacks and creates a secure foundation for cryptographic operations within the processor unit or GPU.

[0098] In a preferred implementation of the system, the external secure element is a tamper-proof hardware device or module that is physically separate from the processor unit or GPU and is designed for the secure storage of cryptographic keys and the enforcement of license terms. The external secure element thus complements existing TPMs or HSMs of the platforms; however, it is not a replacement.

[0099] The physical separation of the external secure element from the processor unit or GPU creates an additional layer of security by isolating critical security functions and enables a clear separation of responsibilities and independent control over licensing and key management, thereby increasing confidence in the overall system.

[0100] A preferred embodiment of the system according to the invention provides that the processor unit includes a trust anchor, preferably a unique, hardware-based trust anchor embedded in the processor unit during its manufacture. Preferably, the trust anchor is embedded in a core, particularly preferably in the confidential core of the processor unit. In this way, the confidential core or processor unit can identify itself to other components or instances, so that, for example, the execution of programs can be restricted to predetermined processor units or confidential cores. Some or all cores of the processor unit, CPU, or GPU can have a trust anchor.

[0101] In a preferred embodiment of the system, the external secure element is a tamper-proof hardware device or module that is physically

[0102] Page 19 of 48. April 13, 2026

[0103] The external secure element is separate from the processor unit and designed for the secure storage of cryptographic keys. Preferably, the external secure element is also designed for enforcing license terms. Preferably, the secure element itself can include a processor to perform certain tasks, such as decrypting or encrypting information or, for example, the cryptographic key.

[0104] In a preferred embodiment of the system, the external secure element is locally connected to a computer, while program execution, licensing, and / or program protection are performed in a processor unit of an external server and / or in a public cloud or a server within a public cloud. This enables local rights management and storage of the necessary cryptographic key during remote execution of a protected, licensed, or encrypted program, model, AI model, or kernel.

[0105] The system, in which the external secure element is locally connected to a computer, allows for the licensing and / or protection or secure execution of a program in a confidential environment in a public cloud or on an external remote server. In this configuration, the tamper-proof external security element (secure element) is preferably physically installed on-site and communicates directly with the local computer, while simultaneously offering the option of handling license validation and security measures via cloud services. The high degree of flexibility in implementing security policies enables companies to maintain direct control over sensitive key components while leveraging the scalability and availability of cloud-based licensing services.

[0106] The hybrid architecture ensures that users retain control over their licensing infrastructure while simultaneously leveraging the scalability and computing power of public cloud services, thereby enabling a

[0107] Page 20 of 48. April 13, 2026

[0108] An optimal balance between security and performance is achieved. The combination of a local security component and cloud-based licensing and computing power creates a dual security concept that unites the advantages of both worlds. The external server or computer in the cloud only needs to have a processor unit with a confidential environment in which the program can be decrypted and executed confidentially and without third-party access.

[0109] The system can further include a configuration for dynamically selecting the computation location based on performance and confidentiality requirements. This intelligent functionality allows the system to automatically decide where specific calculations should be performed—whether locally on the processor or GPU, on the server, or in the cloud—depending on the computing power and data protection requirements of the respective use case. For example, the system can execute highly sensitive calculations locally, while computationally intensive but less sensitive tasks can be offloaded to the cloud. This adaptive location selection optimizes resource utilization while adhering to data protection and security policies, thereby increasing the overall efficiency of the system.

[0110] The invention is explained in more detail below with reference to the attached drawings. These show:

[0111] Figure 1 shows a system with a computer and an external secure element;

[0112] Figure 2 shows a system comprising a computer, an external secure element and a server with a confidential environment and a processor unit;

[0113] Figure 3 shows a schematic representation of the inventive method for protecting a program with an external Secure Element;

[0114] Page 21 of 48. April 13, 2026

[0115] Figure 4 shows a partial procedure with preparatory steps to enable confidential execution of a program;

[0116] Figure 5 shows a schematic representation of the process of an embodiment of a method for the confidential execution of a program.

[0117] Figure 1 shows a system 100 with a processor unit 200 with a confidential environment 210 with at least one core 220 in the confidential environment 210. The system also includes an external secure element 300 which can be connected to a computer 400.

[0118] In the embodiment shown here, the processor unit 200 comprises a controller 230 and an optional trust anchor, referred to as the Trust Anchor 240. The Trust Anchor 240 is an immutable, hardware-based piece of information, a trust basis, which is preferably embedded in the silicon of the core 220.

[0119] In the embodiment shown here, the processor unit 200 is part of the computer 400, to which the external secure element 300 is connected. This connection is established via an interface 410, which provides a wired or wireless connection between the external secure element 300 and the computer 400. The interface 410 can be, for example, a USB port or a wireless Bluetooth interface.

[0120] The processor unit 200, in the configuration shown here, has additional confidential cores 222, which are located in the confidential environment 210. In addition to these confidential cores 222, further cores 220 exist outside the confidential environment 210. All cores 220 are controlled by the controller 230. The confidential cores 222 shown here each have their own trust anchor 240 to verify their identity.

[0121] Page 22 of 4813. April 2026

[0122] An external data processing unit (DPU) 510 belonging to a licensor or rights holder of a program 500 provides the program 500 and transmits it to the computer 400, on which it is to be executed in a confidential environment 210. The program 500 is preferably a model 502 or KL model 504, such as an LLM (Large Language Model), or a kernel 506. The program 500 is encrypted with a cryptographic key 530 and is transmitted as the encrypted program 500 to the computer 400, preferably via a secure connection, wired or wireless. The encrypted program 500 can be stored in the computer 400 in a memory not shown here. However, execution of the encrypted program 500 in the confidential environment 210 is only possible once the computer 400 receives the cryptographic key 530 and can use it for decryption.

[0123] The external computing unit 510 transmits the cryptographic key 530 directly to the external secure element 300, but not to the computer 400 itself.

[0124] The cryptographic key 530 is preferably secured using backup data 520. The backup data 520 can preferably be based on license data and license information of the rights holder of the program 500. The backup data 520 can, for example, include encryption so that the cryptographic key 530 can be encrypted with this backup data 520. In this preferred case, the backup data 520 includes the cryptographic key 530. It is transmitted from the licensor's computing unit 510 to the external secure element 300 and is stored there in encrypted form. The external secure element 300 thus possesses the cryptographic key 530 and makes it available to the processor unit 200, when needed, for decrypting the encrypted program 500.The transfer of the cryptographic key 530 to the processor unit 200, preferably to the confidential environment 210 or preferably to one or more of the confidential cores 222, is preferably carried out.

[0125] Page 23 of 4813. April 2026

[0126] after verifying a possible license for computer 400, preferably via a secure connection.

[0127] In a preferred embodiment, the secure element 300 decrypts the cryptographic key 530 from the backup data 520, since the cryptographic key 530 preferably exists only in this form and is embedded in the backup data 520. The secure element 300 encrypts the cryptographic key 530 with a public encryption key of the processor unit 200 or, preferably, of the trust anchor 240. The resulting encrypted cryptographic key 540 is then transmitted to the processor unit 200, the confidential environment 210, or, preferably, the confidential core 222, to be decrypted there with a private encryption key that forms a key pair with the public encryption key. In this way, secure transmission of the cryptographic key 530 in the form of the encrypted cryptographic key 540 from the secure element 300 to the processor unit 200 is ensured.The public encryption key is preferably provided by the processor unit 200, the confidential environment 210 or, most preferably, by the confidential core 222 and is transmitted to the secure element 300 via a preferably secure connection.

[0128] Preferably, key material can be used to verify a license, which may also include the cryptographic key 530.

[0129] Figure 2 shows a system 100 with a computer 400 and an external secure element 300, as well as with a server 600, which has a processor unit 200 with a confidential environment 210. In the embodiment shown here, an encrypted program 500 is executed securely and confidentially in the confidential environment 210 of the processor unit.

[0130] Page 24 of 4813. April 2026

[0131] unit 200 of the server 600, wherein the cryptographic key 530 required for decrypting the encrypted program 500 is included in the external secure element 300.

[0132] The cryptographic key 530 is transmitted from the computing unit 510 of a licensor to the external secure element 300, preferably in encrypted form and / or via a secure connection. The secure element 300 can be connected to the computer 400 via the interface 410 of the computer 400, preferably in a reversible connection.

[0133] The licensor's computing unit 510 transmits the encrypted program 500 to computer 400. It can be stored there in memory 430. From there, the encrypted program 500 can be transferred to server 600 to be executed confidentially in its processor unit 200. This utilizes the high performance and capabilities of server 600. However, the server itself should not be trusted, so only the encrypted program 500 is transferred from computer 400 to server 600. This preferably occurs via a secure connection using an interface 610, which can be a wireless interface, thus enabling a wireless connection between computer 400 and server 600. Server 600 can be located in the cloud.

[0134] To execute the encrypted program 500 on server 600 in its confidential environment 210 on a confidential core 222, the encrypted program is transferred from computer 400 to server 600, for example, from memory 430 or using a processor 420. Before program 500 can be executed, it must be decrypted. For this purpose, the cryptographic key 530, stored on the external secure element 300, is transferred to server 600 via interface 410 of computer 400. Server 600 can then decrypt and execute the encrypted program 500 in its confidential core 222 using the cryptographic key 530. Thus, program 500 is executed in

[0135] Page 25 of 48. April 13, 2026

[0136] the confidential environment 210. Since the confidential environment 210 includes several confidential kernels 222, it is possible to perform parallelization of the processing of the program 500 and to distribute individual parts of the program 500 or kernel 506 to the confidential kernels 222.

[0137] The transmission of the cryptographic key 530 can preferably also take place here in the form of the encrypted cryptographic key 540, as described above.

[0138] In the embodiment shown here, the confidential cores 222 each comprise a Trust Anchor 240. The Trust Anchor 240 can, for example, store an encryption key pair consisting of a public encryption key and a private encryption key. This encryption key pair can be used for the secure transmission of the cryptographic key 530 from the external Secure Element 300, or from the computer 400 to which the external Secure Element 300 is connected, to the server 600.

[0139] In the preferred embodiment, the Trust Anchor 240 or the processor unit 200 of the server can be configured to create a unique number, nonce, and transmit it to the external Secure Element 300.

[0140] Figure 3 schematically shows the process for protecting a program 500 and for executing it in a confidential environment 210.

[0141] In a first step S1, a licensee 700 requests a license for a program 500 from a licensor 710. In a second step S2, the licensor 710 sends the requested encrypted program 500 from its computing unit 510 to the licensee's computer 400. A third step S3 involves sending a license and backup data 520 and / or key material, which includes the cryptographic key 530 for decrypting the encrypted program 500, to the external secure element 300.

[0142] Page 26 of 4813. April 2026

[0143] These preparatory steps, which are shown again in Figure 4, enable the licensee 700 to execute the encrypted program 500 in a confidential environment 210 of a processor unit 200.

[0144] Such an execution is initiated by a request from the licensee 700 in step S4 for the use of program 500 or KL model 504. In step S5, computer 400 sends the provision of a confidential environment 210 to the processor unit 200 to enable the execution of program 500 or KL model 504 in a confidential core 222. Simultaneously, the provision of an encryption key is requested from the confidential core 222 or, preferably, from the trust anchor 240 of the confidential core 222.

[0145] The confidential core 222 preferably sends a license verification request to the external secure element 300 in step S6. Information from the trust anchor 240 can also preferably be transmitted to the external secure element 300. The external secure element 300 can verify the confidential environment 210 using the information from the trust anchor 240. This can then form the basis for transmitting the cryptographic key 530 to the confidential core 222. The public encryption key of the confidential core 222 is also preferably transmitted.

[0146] Since the external secure element 300 now possesses the public encryption key of the confidential core 222, a secure connection can be established between the external secure element 300 and the confidential core 222 in the confidential environment 210. Preferably, the encryption key used is a certified key. After verifying the license information and confirming a valid license in the external secure element 300, the external secure element 300 transmits the cryptographic key 530 to the confidential core 222 with the trust anchor 240 in step 7. Preferably, this is done beforehand.

[0147] Page 27 of 48. April 13, 2026

[0148] The cryptographic key 530 is encrypted with the public encryption key. This can preferably be done analogously to the procedure described above.

[0149] To transfer the cryptographic key 530 from the secure element 300 to the confidential environment 210, the cryptographic key 530 is encrypted with the public encryption key of the trust anchor 240 or the confidential core 222. The confidential core 222 can decrypt the cryptographic key 530 before it is used, as it has access to the private encryption key. In this way, the cryptographic key 530 can be securely transferred from the external secure element 300 to the confidential core 222.

[0150] In a further step S8, the encrypted program 500 or the encrypted Kl model 504 is loaded into the processor unit 200, preferably into the confidential environment 210, in order to be processed in the confidential kernel 222.

[0151] In step S9, the confidential core 222 decrypts the encrypted Kl model 504 or program 500 using the cryptographic key 530 and executes the program 500 or the Kl model 504. Execution thus takes place in the confidential environment 210 within a confidential core 222, and therefore independently and without the possibility of access by third parties. Since the verification of the confidential environment 210 in the processor unit 200 is based on data from the trust anchor 240 and / or the cryptographic key 530, as well as license information within the external secure element 300, proof of the confidentiality of the processor unit 200 is independent of other sources or authorization units.

[0152] In step S10, the result of the execution of program 500 or the KL model 504 from processor unit 200 is sent to computer 400.

[0153] Page 28 of 48. April 13, 2026

[0154] or transfer to a memory area of ​​computer 400. Thus, in step S11, the result of the calculation is also available to licensee 700, who initiated the calculation.

[0155] The procedure described here can also be carried out with an external server that executes the protected program 500 in a confidential environment 210. The secure element 300 is connected to the computer 400. Communication between the secure element 300 and the confidential environment 210 then takes place via the computer 400, which also transmits the protected or encrypted program 500 to the server 600.

[0156] Figure 4 shows another flowchart of the preparatory steps for the confidential execution of a protected program 500 in a confidential environment 210. A licensor 700, using its computing unit 510, provides a program 500 or a Kl model 504 and encrypts it with a cryptographic key 530. The program 500 is transmitted to a computer 400 and can be stored there, for example, in a non-volatile storage device. Likewise, the licensor 710 transmits the cryptographic key 530 used from its computing unit 510 to an external secure element 300, in which the cryptographic key 530 can be stored. The cryptographic key 530 can, for example, be a symmetric key. The key material, including the cryptographic key, as well as the license for an end user, can be stored on the external secure element 300.The cryptographic key can be encrypted and preferably included in the key material.

[0157] Figure 5 shows the individual steps and the sequence of the processing phase after a license is granted. It illustrates how the individual components, namely the external secure element 300 and the computer 400, as well as the processing unit 200 with its confidential environment 210 and the confidential core 222, work together.

[0158] Page 29 of 48. April 13, 2026

[0159] As soon as a licensee initiates a request to execute a protected program on computer 400, the processor unit 200 is instructed in step S20 to establish or provide a confidential environment 210. The confidential core of the processor unit can establish the confidential environment, which is verified against its information in the associated trust anchor. This is indicated by step S21.

[0160] Step S22 represents the request from computer 400 to the processing unit, requesting a key agreement between the confidential core and the external secure element 300. In step S23, the confidential core selects a nonce and, in step S24, sends it, along with a certified public encryption key, to the external secure element 300. The encryption key is certified by the confidential core's trust anchor.

[0161] Step S25 represents the validation of the nonce and the certified public encryption key of the confidential kernel in the external Secure Element 300. This validation is performed using a trusted root certificate, which may be present in the external Secure Element 300 and was, for example, provided by a Trusted Authority. In step S26, license information for the protected program, KL model, or kernel is transmitted from computer 400 to the external Secure Element 300.

[0162] Preferably, the cryptographic key is not present in readable form in the external secure element 300, but only in encrypted form, for example, embedded in backup data 520. Using key material or, preferably, the license information, the cryptographic key is extracted from the backup data. If the external secure element 300 does not have the cryptographic key, it can alternatively be stored in encrypted form on the computer 400 and is also transferred to the external secure element in step S26.

[0163] Page 30 of 48. April 13, 2026

[0164] Step S27 demonstrates that the encrypted cryptographic key can be decrypted using backup data, key material, or other license information and is now available unencrypted for further operations. In step S28, the cryptographic key is encrypted with the public encryption key of the confidential core and preferably the transmitted nonce, in order to be transmitted in step S29 via computer 400 to processor unit 200. Decryption of the cryptographic key with the private encryption key of the confidential core takes place in step S30. The cryptographic key has thus been securely and immutably transferred from the protected external Secure Element 300 to the confidential environment of processor unit 200.

[0165] In step S31, the encrypted program or the encrypted AI model is transferred to the confidential kernel 222 and made available there. In step S32, the encrypted program or the encrypted AI model is decrypted using the cryptographic key. In step S33, the program or AI model is executed as usual within the confidential environment 210 using the confidential kernel 222.

[0166] The result of the program or AI model execution is transmitted in step S34 to computer 400 or to a storage unit or memory area within the computer. This transmission can be unencrypted, as the results of the program or AI model calculation are intended to be freely accessible.

[0167] The described procedure can also be carried out in the same way if the processor unit 200 is located in a server instead of the computer 400, for example, and the program is executed on the server. In this case, secure transmission of the cryptographic key required for decryption to the confidential environment and the confidential core is also ensured. The transmission also takes place from an external secure element connected to a computer.

[0168] Page 31 of 48. April 13, 2026

[0169] A practical application of the method according to the invention involves a provider creating a proprietary AI model that is to be hosted not only in a public cloud but also on-premises at a customer's site. The AI ​​model is to be licensed for licensing purposes or for other purposes.

[0170] The method can also be used with other confidential cores, especially GPU cores. In GPU-accelerated use cases, for example, owners can license or protect the model in this way. For instance, scientific or physical calculations whose content must remain confidential can be performed securely in a public cloud. Examples include industrial simulations, wind tunnels, fluid dynamics, and climate or weather forecasts. Other such use cases include video processing, rendering, 3D modeling, and ray tracing.

[0171] In research or medical applications, the method could be used to protect the development of new molecular structures as well as genome sequencing or protein folding simulations.

[0172] One possible use case involves the protection of Retrieval Augmented Generation Systems (RAG), where, for example, company data, legal or medical documents are added during execution on a confidential core to a query of a KL model or an LLM model.

[0173] The method also provides protection when using a licensed AI model in a public cloud, where the external secure element is not located in the cloud, but rather on the end user's computer. After licensing, the end user dynamically decides which public cloud provider to use for running the model. This creates flexibility and can, for example, result in faster execution.

[0174] Page 32 of 4813. April 2026

[0175] This method is also suitable for custom GPU kernels that are deployed locally and need to be protected against reverse engineering. Kernels for optimized GPU processors and confidential GPU kernels can be encrypted and securely transmitted to the respective cores, thus protecting them from unauthorized access.

[0176] The increasing prevalence of artificial intelligence (AI) technologies and AI models is leading to a greater processing of confidential data using proprietary algorithms and kernels. This data is processed in public clouds as well as on private instances or enterprise computers. The invention enables location-independent license management and also provides key material for encrypting sensitive data. This allows for seamless license management and encryption key provision regardless of the processing location, ensuring mobility between devices and eliminating dependence on cloud infrastructure (no internet dependency due to on-premises trust) or on specific devices thanks to flexible license management independent of the confidential core and processor unit.The inventive method and system integrate existing cryptographic primitives such as confidential environments or "confidential computing" and utilize local trusted anchors to provide key material for encrypting sensitive data. Cryptographic keys can be stored not only in the external secure element but also in the AI ​​models or programs. This allows the license to be managed independently of the computation and provision of key material for encrypting sensitive information. As a result, the location of the computation can be dynamically selected based on performance and confidentiality requirements. These features enable new, customized business models for protecting information.

[0177] DEFINITIONS

[0178] Page 33 of 4813. April 2026

[0179] The term "nonce" refers to a number or value used only once to enhance the security of cryptographic protocols. A nonce can be used in communication protocols between the trust anchor and the external secure element to prevent replay attacks, where an attacker resends a previously intercepted message. The system can be configured to use protocols with or without a nonce, providing flexibility in implementing various security requirements. One example of using a nonce is incorporating a unique random number into each authentication request between the external secure element and the trusted execution core, ensuring that each communication session is uniquely identifiable and cannot be repeated.

[0180] The term "trust anchor" refers to a hardware-based trust anchor embedded in the processing unit (PU) or GPU, acting as a tamper-proof root of trust. A trust anchor (TA) is immutable, hardware-based information, a trust base embedded in the silicon of the processor core or processing unit (PU), for example, in a "Trusted Execution Core" (TEC), referred to here as a trusted core.

[0181] A “Trusted Execution Core” (TEC), also called a confidential core or confidential environment, refers to a processing element (CPU / GPU core or other processing accelerator) that runs in a confidential, usually secure, isolated environment within a processor unit or computer system designed to execute sensitive code (such as proprietary AI models or kernels).

[0182] The Trusted Execution Core can be configured to securely execute proprietary AI models within a confidential execution environment. The Trusted Execution Core can authenticate with an external secure element using pre-shared cryptographic keys, verify license terms, and, if authorized, decrypt the model for execution in an isolated, tamper-proof environment.

[0183] Page 34 of 48. April 13, 2026

[0184] Currently, trusted execution environments (TEE, https: / / en.wikipedia.org / wikiT) are used to protect (AI) models for central processing units (CPUs) and graphics processing units (GPUs), and this is known as “Confidential Computing”.

[0185]

[0186] ( >,ni * .. iv A'j '.v, v « AU ) is used, which is supported by various hardware vendors. The focus of this approach is on protecting the confidentiality of end-user data in the context of public data centers or public cloud computing services, although it can also be used in private data centers and computers. This ensures that the core code and data remain confidential and their integrity is protected, even if the surrounding operating system or runtime environment is compromised.

[0187] In contrast, the protection of sensitive codes through obfuscation is based on software-based encryption of codes / data.

[0188] The term "kernel" refers to the core part of a program or model. In the context of graphics processing units (GPUs), a kernel can be a small program that runs on the GPU and performs a specific task, such as matrix multiplication or convolution. The kernel can be a proprietary GPU kernel that is part of the AI ​​model and needs to be protected from unauthorized use. A kernel can be a low-level program, module, or program component that is designed for high performance and / or efficient execution. The kernel is preferably compiled in a way that allows it to be executed by the processor unit, CPU, or GPU.

[0189] The term "model" refers to a proprietary software element or program used for specific tasks. It represents software belonging to a copyright holder and must be protected from unauthorized use or copying. The model can be transmitted in encrypted form and decrypted only within the trusted execution environment of the PU (Public Enterprise). The model can be an "AI model" and a proprietary artificial intelligence model, such as a deep learning model or LLM (Laser Learning Model).

[0190] Page 35 of 48. April 13, 2026

[0191] The model includes elements used for specific tasks such as image recognition, natural language processing, or scientific simulations.

[0192] The term "secure element" or "external secure element" refers to a tamper-proof hardware device, module, component, or element that is physically separate from the GPU or processor unit and designed for the secure storage of cryptographic keys and the enforcement of license terms. The secure element can act as an independent, external trusted authority and may have non-volatile memory. It can be located locally on-premises or remotely in the cloud and can manage (certified) cryptographic keys, validate license entitlements before decryption, and establish a secure channel with the processor unit or GPU's trust anchor.

[0193] The secure element is external with respect to the processor unit, the processor unit's confidential environment, the processor unit's confidential core, and / or a TPM. In any case, the external secure element is not part of the processor unit or the confidential environment. "External" means functionally, logically, and / or physically separate and not integrated. "External" can also refer to the server or computer.

[0194] The secure element is logically separate from the processor unit and can preferably be operated, used, or executed completely independently of the processor unit, the TPM, the secure or confidential environment, and / or the secure or confidential core.

[0195] The fact that the secure element can be connected to the computer includes not only physical connection and physically detachable connection, such as inserting a dongle, memory card, or external hard drive into a suitable interface, but also functional or logical connection, such as mounting the secure element into the computer system or operating system.

[0196] Page 36 of 4813. April 2026

[0197] The computer or server's system. A physical connection may also exist before mounting. This could be the case, for example, if the external secure element is integrated into a chip, ASIC, or other component (outside the processor unit or the confidential environment) within the computer.

[0198] Mounting or connecting the secure element also includes initializing the secure element when it is integrated into a computer (but outside the processor unit or confidential environment). After initialization, the secure element is connected to the computer.

[0199] The term "processor unit" encompasses all types of processors or processor units, in particular GPUs and CPUs (Central Processing Units) of computers, servers or other electronic devices.

[0200] The term "GPU" refers to a graphics processing unit that provides parallel processing capabilities and enables the efficient execution of AI models, including deep learning networks, image recognition systems, and natural language processing applications. The GPU can provide a secure computing environment and include a trust anchor configured for the secure execution of proprietary models and kernels.

[0201] The invention has been comprehensively described and explained with reference to the drawings and the description. The description and explanation are to be understood as examples and not as limiting. The invention is not limited to the disclosed embodiments. Other embodiments or variations will become apparent to a person skilled in the art when using the present invention and upon a detailed analysis of the drawings, the disclosure, and the subsequent claims.

[0202] In the patent claims, the words "comprise" and "with" do not preclude the presence of further elements or steps. The undefined article

[0203] Page 37 of 48. April 13, 2026

[0204] The use of "a" or "an" does not preclude the existence of multiple elements. A single element or unit can perform the functions of several of the units mentioned in the claims. An element, unit, device, and system can be implemented partially or completely in hardware and / or software. The mere mention of some measures in several different dependent claims is not to be understood as precluding the advantageous use of a combination of these measures. Reference numerals in the claims are not to be interpreted restrictively.

[0205] Page 38 of 48. April 13, 2026

[0206] Reference symbol list

[0207] 100 System;

[0208] 200 processor units;

[0209] 210 Confidential environment;

[0210] 220 cores;

[0211] 222 Confidential Core;

[0212] 230 controllers;

[0213] 240 Trust Anchor;

[0214] 300 external secure elements;

[0215] 400 computers;

[0216] 410 interface;

[0217] 420 processor;

[0218] 430 storage

[0219] 500 program;

[0220] 502 model;

[0221] 504 Kl model;

[0222] 506 kernel;

[0223] 510 computing units;

[0224] 520 backup data;

[0225] 530 Cryptographic key;

[0226] 540 Encrypted cryptographic keys 600 Servers;

[0227] 610 interface;

[0228] 700 licensees;

[0229] 710 Licensors

[0230] Page 39 of 48

Claims

April 13, 2026 Patent claims 1. Method for protecting a program (500) by confidentially executing the program (500) in a confidential environment (210) of a processor unit (200) of a computer (400) or server (600), comprising the following steps: - Providing a processor unit (200) with a confidential environment (210) and with at least one confidential core (222) which is a secure core (220) in the confidential environment (210); - Providing an encrypted program (500) to be executed in the confidential environment (210); - Providing an external secure element (300) that can be connected to the computer (400) and that includes a cryptographic key (530) for decrypting the encrypted program (500) and license data; - Connecting the external secure element (300) to the computer (400); - Perform a license check for the cryptographic key in the external Secure Element (300) using the license data; - Transfer of the cryptographic key (530) from the external secure element (300) to the processor unit (200) upon successful license verification; - Decryption of the encrypted program (500) using the cryptographic key (530); - Execution of the decrypted program (500) within the confidential environment (210) of the processor unit (200). Page 40 of 48. April 13, 2026 2. Method according to claim 1, wherein the program (500) comprises a model (502), a KL model (504) or a kernel (506).

3. Method according to claim 1 or 2, wherein the transmission between the external secure element (500) and the processor unit (200) is based on a secure connection and the establishment of the secure connection is based on encryption keys, preferably on certified keys, particularly preferably on keys provided in the processor unit (200) and on the external secure element (300), preferably in the confidential core (222).

4. A method according to any of the preceding claims, characterized by the following steps: Encrypting the cryptographic key (530) with a public encryption key of the processor unit (200), preferably of the confidential core (222), into a transferable encrypted cryptographic key (540) before transmission to the processor unit (200); Decrypting the transmitted encrypted cryptographic key (540) with a private encryption key which forms a key pair with the public encryption key in order to use the cryptographic key (530) to decrypt the encrypted program (500), wherein the decryption preferably takes place in the processor unit (200), particularly preferably in the confidential environment (210), and very preferably in the confidential core (222).

5. Method according to one of the preceding claims, characterized by the further step: confidential transmission of the encrypted program (500), an encrypted model (502) or kernel (506) or other Page 41 of 48. April 13, 2026 Data to the confidential core (222) of the processor unit (200), preferably from an instance or computer of a rights holder or licensor of the program, The transfer preferably only takes place after successful license verification by the external secure element.

6. A method according to any of the preceding claims, characterized by the steps: Securing the cryptographic key (530) using backup data (520); Transmitting the secured cryptographic key (530) to the external secure element (300); Providing the backup data (520) to the external secure element (300); Unlocking the secured cryptographic key (530) by the external secure element (300) when required; where the backup data (520) is preferably based on license data or license information from a rights holder of the program.

7. Method according to any of the preceding claims, wherein the confidential core (222) comprises a trust anchor associated with a UID certificate, preferably to ensure the authenticity of the trust anchor.

8. Method according to any of the preceding claims, wherein key material for the encryption and decryption of user data, licenses, license data and / or other data for a license check can be provided by the external secure element (300), wherein the key material preferably comprises the cryptographic key (530). Page 42 of 48. April 13, 2026 9. Method according to any of the preceding claims, wherein the licensing of the program (500), model (502) and / or kernel (506) and / or the protection is independent of central structures and independent of execution in a local environment or in a public cloud and / or independent of public infrastructure, so that offline execution is also possible.

10. Method according to one of the preceding claims, characterized in that the processor unit (200) is part of a server (600), preferably a server (600) in the cloud, the external secure element (300) is connected to the computer (400); the computer (400) transmits the encrypted program (500) to the server (600); and the computer (400) initiates the execution of the program (500) in the confidential core (222) of the processor unit (200) of the server (600), preferably a secure connection exists or is established between the external secure element (300) and / or computer (400) and server (600).

11. Method according to any of the preceding claims, wherein a protocol is used for communication between the external secure element (600) and the confidential core (222) with or without a nonce.

12. A method according to any of the preceding claims, comprising the further steps: Page 43 of 48. April 13, 2026 Initiating the decryption process of the program (500), model (502) or kernel (506), preferably by the user of the computer (400); Providing an encryption key pair consisting of a public encryption key and a private encryption key, preferably in the confidential core (222) or a trust anchor (240) in the confidential core (222); Requesting the public encryption key of the processor unit (200), preferably a certified public encryption key, particularly preferably a public encryption key certified by a Trust Anchor (240); Optional creation of a nonce; Transmitting the public encryption key and optional nonce from the processor unit (200) to the external secure element (300); Validating the optional nonce and public encryption key, preferably against a trusted root certificate, preferably in the external secure element (300); Encrypting the cryptographic key (530) with the public encryption key; Transmitting the encrypted cryptographic key (530) and optionally further license information from the external secure element (300) to the processor unit (200); Receiving and decrypting the encrypted cryptographic key (530) in the processor unit (200), preferably in the confidential core (222) of the processor unit (200), particularly preferably in a trust anchor (240) of the processor unit (200), with the private Page 44 of 48. April 13, 2026 Encryption key of the public encryption key.

13. Method according to the preceding claim, characterized by the further steps: Providing the cryptographic key (530) to the external secure element (300); Optional provision of license information of the program (500), model (502) and / or kernel (506).

14. System (100) for protecting a program (500) with the aim of confidentially executing the program (500) in a confidential environment of a processor unit (200), comprising: - the processor unit (200) with a confidential environment (210) and with at least one confidential core (222) which is a core (220) in the confidential environment (210); - an external Secure Element (300) that can be connected to a computer (400) and that is configured to store a cryptographic key (530) and to perform a license check of the use of the cryptographic key (530) based on stored license data; - where the system (100) is configured to: - Establishing a secure connection between the computer (400) and / or the external secure element (300) and the processor unit (200); - confidential transmission of a program (500), model (502) or kernel (506) or other data to the confidential kernel (222) using the secure connection; Page 45 of 48. April 13, 2026 - Transfer of the cryptographic key (530) to the confidential core (222) from the external secure element (300) upon successful license verification; - Decryption of the program (500), model (502) or kernel (506) using the cryptographic key (530) in the confidential kernel (222); - Execution of the decrypted program (500), model (502) or kernel (506) within the confidential environment (210) of the processor unit (200).

15. System (100) according to claim 14, wherein the processor unit (200) comprises a Trust Anchor (240) which is a hardware-based trust anchor embedded in the processor unit (200) during the manufacture of the processor unit (200), preferably in the confidential core (222) of the processor unit (200).

16. System (100) according to claim 14 or 15, wherein the external secure element (300) is a tamper-proof hardware device or module that is physically separate from the processor unit (200) and is designed for the secure storage of cryptographic keys (530) and preferably for the enforcement of license terms.

17. System (100) according to one of claims 14 to 16, wherein the external secure element (300) is connected locally to a computer (400), while the execution of the program (500), licensing and / or protection of the program (500) is carried out in a processor unit (200) of an external server (600) and / or in a public cloud.

18. External secure element (300) for storing a cryptographic key (530) for a system (100) according to one of claims 14 to 17, characterized in that the external secure element (300) Page 46 of 48. April 13, 2026 is trained to encrypt the cryptographic key (530) with a received encryption key.

19. Processor unit (200) with a confidential environment (210) and with at least one confidential core (222) comprising a core (220) in the confidential environment (210), wherein the confidential core (222) or the confidential environment (210) comprises a Trust Anchor (240) which is embedded in the confidential core (222) or the environment (210) during the manufacture of the processor unit (200) and is immutable and serves to identify or authenticate the confidential core (222) or the environment (210).

20. Processor unit (200) according to the preceding claim, characterized in that the confidential kernel (222) or confidential environment (210) or embedded trust anchor (240) comprises proprietary programs (500), models (502), kernel (506) and / or cryptographic keys (530) preloaded by the manufacturer of the processor unit (200), thereby enabling the manufacturer to directly control license terms for the programs (500), models (502), kernel (506) and / or cryptographic keys (530). Page 47 of 48

Images