Patent ID: 11870898
Assignee: WORKDAY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. A method for key storage, comprising:
receiving an indication to create a credential issuing authority encrypted recovery encryption key share and a trusted organization encrypted recovery encryption key share;
creating, using a processor, two recovery encryption key shares based at least in part on a recovery encryption key;
determining a credential issuing authority public key associated with a credential issuing authority;
encrypting a first recovery encryption key share using the credential issuing authority public key to generate a credential issuing authority encrypted recovery encryption key share, wherein the credential issuing authority public key is associated with the credential issuing authority;
providing the credential issuing authority encrypted recovery encryption key share to the credential issuing authority;
querying the credential issuing authority for a determination of a trusted organization using an identification validation credential;
encrypt a second recovery encryption key share using the trusted organization public key to generate a trusted organization encrypted recovery encryption key share, wherein the trusted organization public key is associated with the trusted organization; and
providing the trusted organization encrypted recovery encryption key share to the trusted organization, and
creating a user private key, comprising:
providing to the credential issuing authority an encrypted key request token and a request for an encrypted backup copy of the user private key, wherein the encrypted key request token is received from the credential issuing authority;
receiving the encrypted backup copy of the user private key from the credential issuing authority; and
determining the user private key using a recovered encryption key and the encrypted backup copy of the user private key.