Remote station for deriving a derivative key in a system-on-a-chip device

An integrated circuit, comprising:

• means for receiving a delegate certificate, wherein the delegate certificate includes signed metadata governing a security policy;
• means for validating a digital signature of the delegate certificate using a public key;
• and
• means for generating a derivative key using a secret key securely stored in the integrated circuit and using the signed metadata as inputs to a key derivation function.

A remote station, comprising:

• a processor configured to:
• receive a delegate certificate having a digital signature based on the delegate certificate;
• validate the digital signature using a public key;
• and
• generate a derivative key using a secret key securely stored in the processor and using the digital signature as inputs to a key derivation function.

A remote station, comprising:

• a processor configured to:
• receive a delegate certificate, wherein the delegate certificate includes a first public key;
• validate a digital signature of the delegate certificate using a second public key;
• and
• generate a derivative key using a secret key securely stored in the processor and using the first public key as inputs to a key derivation function.