System and method for managing cryptographic keys
First Claim
1. A method implemented on a first computing device, the method comprising:
- retrieving, from a memory, encrypted data encrypted using a first key;
retrieving, from the memory, a fourth key;
transmitting, to a second computing device, a request for an encrypted first key, wherein the encrypted first key is generated by encrypting the first key using a second key;
receiving, from the second computing device, the encrypted first key;
transmitting, to an identity and access management device (IAM), a request for an encrypted second key, wherein the encrypted second key is generated by encrypting the second key using a third key;
receiving, from the IAM, the encrypted second key;
transmitting, to the second computing device, a request for an encrypted third key, wherein the encrypted third key is generated by encrypting the third key using the fourth key;
receiving, from the second computing device, the encrypted third key;
decrypting the encrypted third key using the fourth key;
decrypting the encrypted second key using the third key;
decrypting the encrypted first key using the decrypted second key;
decrypting the encrypted data using the decrypted first key; and
deleting, from a cache of the first computing device, the decrypted first key after a period of time.
3 Assignments
0 Petitions
Accused Products
Abstract
In various implementations, a first device retrieves, from a memory, encrypted data encrypted using a first key. The first device transmits, to a second device, a request for an encrypted first key, where the encrypted first key is generated by encrypting the first key using a second key. The first device receives the encrypted first key. The first device transmits, to an identity and access management device (IAM), a request for an encrypted second key, where the encrypted second key is generated by encrypting the second key using a third key. The first device receives the encrypted second key. The first device decrypts the encrypted second key using the third key, decrypts the encrypted first key using the decrypted second key, and decrypts the encrypted data using the decrypted first key. The first device deletes, from its cache, the decrypted first key after a period of time.
-
Citations
11 Claims
-
1. A method implemented on a first computing device, the method comprising:
-
retrieving, from a memory, encrypted data encrypted using a first key; retrieving, from the memory, a fourth key; transmitting, to a second computing device, a request for an encrypted first key, wherein the encrypted first key is generated by encrypting the first key using a second key; receiving, from the second computing device, the encrypted first key; transmitting, to an identity and access management device (IAM), a request for an encrypted second key, wherein the encrypted second key is generated by encrypting the second key using a third key; receiving, from the IAM, the encrypted second key; transmitting, to the second computing device, a request for an encrypted third key, wherein the encrypted third key is generated by encrypting the third key using the fourth key; receiving, from the second computing device, the encrypted third key; decrypting the encrypted third key using the fourth key; decrypting the encrypted second key using the third key; decrypting the encrypted first key using the decrypted second key; decrypting the encrypted data using the decrypted first key; and deleting, from a cache of the first computing device, the decrypted first key after a period of time. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method implemented on a system comprising an application server, a cryptographic key management server (KMS), and an identity and access management device (IAM), the method comprising:
-
retrieving, by the application server from a memory, encrypted data that is encrypted using a first key; retrieving, by the application server from the memory, a fourth key; transmitting, from the application server to the KMS, a request for an encrypted first key, wherein the encrypted first key is generated by encrypting the first key using a second key; transmitting, from the KMS to the application server, the encrypted first key; transmitting, from the application server to the IAM, a request for an encrypted second key, wherein the encrypted second key is generated by encrypting the second key using a third key; transmitting, from the IAM to the application server, the encrypted second key; transmitting, from the application server to the KMS, a request for an encrypted third key, wherein the encrypted third key is generated by encrypting the third key using the fourth key; transmitting, from the KMS to the application server, the encrypted third key; decrypting, by the application server, the encrypted third key using the fourth key; decrypting, by the application server, the encrypted second key using the third key; decrypting, by the application server, the encrypted first key using the decrypted second key; decrypting, by the application server, the encrypted data using the decrypted first key; and deleting, from a cache of the application server, the decrypted first key after a period of time. - View Dependent Claims (8, 9, 10, 11)
-
Specification