Patent ID: 9690941
Date: 2017-06-27
CPC Classifications: G06F,H04L

Claim:
1. A method performed by a key service provider connected to a first machine and a second machine, comprising: encrypting a key blob using a cryptographic encryption key corresponding to a trusted execution environment on the first machine corresponding to a client to create an encrypted key blob, the cryptographic encryption key corresponding to a cryptographic decryption key accessible to the trusted execution environment, the trusted execution environment being at least partially implemented as hardware in the first machine and being configured to provide for confidential and secure creation of client keys in the first machine; wrapping the encrypted key blob with a platform policy corresponding to a platform boot state of the first machine; provisioning the encrypted key blob to the client at the first machine after the wrapping; receiving a request to re-wrap the encrypted key blob based upon a second trusted execution environment of the second machine, the second trusted execution environment being at least partially implemented as hardware in the second machine and being configured to provide for confidential and secure creation of client keys in the second machine; and encrypting the key blob with a second cryptographic encryption key corresponding to the second trusted execution environment on the second machine to create a re-wrapped encrypted key blob, said encrypting comprising wrapping the re-wrapped encrypted key blob with a second platform policy corresponding to a second platform boot state of the second machine.