Patent ID: 9071429
Filing Date: 2015-06-30
Classification: H04L

Abstract:
1. A computer implemented method for managing a cryptographic key, comprising: storing, in a data store managed by a key management service, a cryptographic key for use in encrypting data for a customer of a service provider associated with the cryptographic key, the key management service being operated in a service provider environment of the service provider; receiving a suspend request to suspend storage of the cryptographic key by the key management service; generating a restore key to be associated with the customer; encrypting the cryptographic key with the restore key; encrypting at least a portion of metadata associated with the cryptographic key under the restore key to generate encrypted metadata, the at least a portion of metadata being associated with the restore key; updating the at least a portion of metadata with audit information and retaining a copy of the encrypted metadata at the key management service; sending, to the customer, the cryptographic key as encrypted under the restore key; destroying any copy of the cryptographic key stored by the key management service; receiving a restore request to cause to the key management service to store a copy of the cryptographic key, the restore request including a copy of the cryptographic key as encrypted under the restore key; comparing at least a copy of metadata received with the restore request with the copy of the encrypted metadata at the key management service; authorizing the restore request based at least in part on the comparing; and decrypting the copy of the cryptographic key as encrypted under the restore key using the restore key and storing the copy of the cryptographic key and a copy of the encrypted metadata in the key management service on behalf of the customer.