A method performed by a card computing device , comprising: hosting on the card computing device a virtualized execution environment comprising an application layer and a platform layer , wherein the virtualized execution environment is configured to host execution of applications written in a platform-independent object-oriented language at the application layer, and to provide device-level functionality at the platform layer to support the execution of the applications; providing on the card computing device a non-secure memory area and a cryptographically secure memory area for the virtualized execution environment, wherein the non-secure memory is accessible via the application layer, and the secure memory area is not directly accessible from the application layer; providing initial data from an application to a key derivation module within the platform layer of the virtualized execution environment; deriving, by the key derivation module using key derivation functionality implemented as part of hardware of the card computer device, a cryptographic key , based on a master key and random data from a random number generator in the platform layer which is initialized using the initial data from the application, wherein the secure memory area represents a security domain "SD" of the card computing device and the master key is stored within this SD; storing the derived key in the cryptographically secure memory area without storing, even temporarily, any portion of the derived key in the non-secure memory; and returning a key reference for the derived key from the key derivation module to the application. hosting on the card computing device a virtualized execution environment comprising an application layer and a platform layer , wherein the virtualized execution environment is configured to host execution of applications written in a platform-independent object-oriented language at the application layer, and to provide device-level functionality at the platform layer to support the execution of the applications; providing on the card computing device a non-secure memory area and a cryptographically secure memory area for the virtualized execution environment, wherein the non-secure memory is accessible via the application layer, and the secure memory area is not directly accessible from the application layer; providing initial data from an application to a key derivation module within the platform layer of the virtualized execution environment; deriving, by the key derivation module using key derivation functionality implemented as part of hardware of the card computer device, a cryptographic key , based on a master key and random data from a random number generator in the platform layer which is initialized using the initial data from the application, wherein the secure memory area represents a security domain "SD" of the card computing device and the master key is stored within this SD; storing the derived key in the cryptographically secure memory area without storing, even temporarily, any portion of the derived key in the non-secure memory; and returning a key reference for the derived key from the key derivation module to the application. <EOS>