A device has a symmetric device key (DK) and a copy of (DK) encrypted according to a public key (PU) of an entity (PU(DK)). The device receives an object from a host computer, at least a portion of which is encrypted according to (DK). The device sends (PU(DK)) to the host computer, and the host computer sends (PU(DK)) to the entity. The entity applies a corresponding private key (PR) to (PU(DK)) to obtain (DK) and sends (DK) to the host computer. The host computer may then encrypt the object according to (DK) and download same to the device, and the device may decrypt the encrypted object based on (DK).