Cryptographic entropy tree

A security system of a device, comprising:

• a secure memory inaccessible to a main processor of the device;
• and
• a secure processor coupled to the secure memory, wherein the secure processor is configured to:
• generate a first cryptographic key based on a first pseudorandom value;
• generate a second pseudorandom value;
• store the first cryptographic key and the first pseudorandom value in the secure memory;
• perform a key derivation function to generate a second cryptographic key based on the second pseudorandom value;
• encrypt the second pseudorandom value using the first cryptographic key;
• send the encrypted second pseudorandom value to the main processor, wherein the main processor is configured to store the encrypted second pseudorandom value in a memory accessible to the main processor, wherein the secure processor is configured to regenerate the second cryptographic key in response to receiving the encrypted second pseudorandom value from the main processor and decrypting the encrypted second pseudorandom value using the first cryptographic key;
• and
• prevent regeneration of the second cryptographic key by overwriting the first pseudorandom value to prevent regeneration of the first cryptographic key and decryption of the encrypted second pseudorandom value with the first cryptographic key.

A security method comprising:

• generating, by a secure processor of a device, a first pseudorandom value;
• generating, by the secure processor, a first key based on the first pseudorandom value;
• generating, by the secure processor, a second pseudorandom value;
• generating, by the secure processor, a second key based on the second pseudorandom value;
• storing, by the secure processor, the first key and the first pseudorandom value in a secure memory coupled to the secure processor, wherein the secure memory is accessible to the secure processor and inaccessible to a main processor of the device;
• encrypting, by the secure processor, the second pseudorandom value using the first key;
• storing, by the main processor, the encrypted second pseudorandom value in accessible memory coupled to the main processor, wherein the accessible memory is accessible to the main processor, and wherein the stored encrypted second pseudorandom value is decryptable by the first key to regenerate the second key based on the decrypted second pseudorandom value;
• and
• revoking, by the secure processor, the second key by removing the first pseudorandom value from the secure memory to prevent a regeneration of the first key usable to decrypt the encrypted second pseudorandom value used to generate the second key.

A security system of a device, comprising:

• a secure memory inaccessible to a main processor of the device;
• and
• a secure processor coupled to the secure memory, wherein the secure processor is configured to:
• generate a first pseudorandom value used to generate a first key;
• generate a second pseudorandom value used to generate a second key;
• store the first key and the first pseudorandom value in the secure memory;
• encrypt the second pseudorandom value with the first key;
• cause the encrypted second pseudorandom value to be stored in a memory accessible to the main processor, wherein the stored encrypted second pseudorandom value is decryptable by the first key to regenerate the second key based on the decrypted second pseudorandom value;
• and
• revoke the second key by replacing the first pseudorandom value in the secure memory to prevent regeneration of the first key usable to decrypt the encrypted second pseudorandom value usable to regenerate the second key.