Patent ID: 9660970
Date: 2017-05-23
CPC Classifications: H04L

Claim:
1. A computer-implemented method comprising: identifying a subset of hardware security modules from a fleet of hardware security modules based at least in part on fleet-configuration information maintained in a fleet information store on one or more computer systems; distributing a domain key to each hardware security module in the subset of hardware security modules; and receiving a notification from a first hardware security module, the notification identifying a cryptographic key stored on the first hardware security module that has been updated, the first hardware security module belonging to the subset of hardware security modules; receiving, from the first hardware security module, the cryptographic key in an encrypted form that is encrypted with a fleet key and the domain key; distributing the cryptographic key to a fleet management agent running on a second hardware security module in the subset of hardware security modules, the second hardware security module containing a copy of the fleet key and the domain key; and causing the fleet management agent to decrypt the cryptographic key using the fleet key and the domain key, and retain the cryptographic key in a key store located on the second hardware security module.