Patent ID: 11870898
Assignee: WORKDAY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 9:
10. A system for key storage, comprising:
an interface configured to:
receive an indication to create a credential issuing authority encrypted recovery encryption key share and a trusted organization encrypted recovery encryption key share; and

a processor configured to:
create two recovery encryption key shares based at least in part on a recovery encryption key;
determine a credential issuing authority public key associated with a credential issuing authority;
encrypt a first recovery encryption key share using the credential issuing authority public key to generate a credential issuing authority encrypted recovery encryption key share, wherein the credential issuing authority public key is associated with the credential issuing authority;
provide the credential issuing authority encrypted recovery encryption key share to the credential issuing authority;
query the credential issuing authority for a determination of a trusted organization using the first identification validation credential;
encrypt a second recovery encryption key share using the trusted organization public key to generate a trusted organization encrypted recovery encryption key share, wherein the trusted organization public key is associated with the trusted organization; and
provide the trusted organization encrypted recovery encryption key share to the trusted organization, and
create a user private key, comprising to:
provide to the credential issuing authority an encrypted key request token and a request for an encrypted backup copy of the user private key, wherein the encrypted key request token is received from the credential issuing authority;
receive the encrypted backup copy of the user private key from the credential issuing authority; and
determine the user private key using a recovered encryption key and the encrypted backup copy of the user private key.