System and method for deriving secrets from a master key bound to an application on a device

A system comprising:

• a device comprising one or more microprocessors;
• a trusted execution environment operating on said device wherein the trusted execution environment includes a trusted operating system (OS) and is associated with a master key;
• a trusted application of a service provider deployed in the trusted execution environment wherein the trusted application is associated with an identifier and wherein the trusted application comprises binary code/data;
• a key derivation function operating in the trusted execution environment;
• wherein when the key derivation function is configured to derive a secret bound to the trusted application to protect business information of said service provider, wherein the key derivation function derives said secret using a first cryptographic function which utilizes a first hash algorithm which takes as input:
• said master key associated with said device, wherein said master key is maintained by the trusted execution environment, and
• a digest derived from said binary code/data of said trusted application, wherein said digest comprises a bit string derived from a second cryptographic function which utilizes a second hash algorithm which takes said binary code/data of said trusted application as input;
• whereby, if another trusted application deployed in the trusted execution environment has another identifier identical to the identifier of the trusted application, the another trusted application is unable to retrieve said secret bound to the trusted application.

A non-transitory machine-readable storage medium having instructions stored thereon for supporting management of a device, which instructions, when executed, cause the device to perform steps comprising:

• providing a trusted execution environment operating on said device wherein the trusted execution environment operating on said device is associated with a master key;
• deploying a trusted application of a service provider in the trusted execution environment wherein the trusted application is associated with an identifier and wherein the trusted application comprises binary code/data;
• providing a key derivation function in the trusted execution environment;
• using the key derivation function to derive a secret bound to the trusted application to protect business information of said service provider, wherein the key derivation function derives said secret using a first cryptographic function which utilizes a first hash algorithm which takes as input:
• said master key associated with said device, wherein said master key is maintained by the trusted execution environment, and
• a digest derived from said binary code/data of said trusted application, wherein said digest comprises a bit string derived from a second cryptographic function which utilizes a second hash algorithm which takes said binary code/data of said trusted application as input;
• whereby if another trusted application deployed in the trusted execution environment has another identifier identical to the identifier of the trusted application, the another trusted application is prevented from retrieving said secret bound to the trusted application.