Patent ID: 9026805
Filing Date: 2015-05-05
Classification: G06F,H04L

Abstract:
1. A method of providing distributed key management (DKM) in a DKM system comprised of DKM client computers and a DKM server, each DKM client computer comprising a trusted platform module (TPM), the method comprising: sharing DKM keys among DKM clients, wherein TPMs of the DKM clients are used to decrypt the DKM keys with TPM private keys, and wherein software cryptography components are used to encrypt the DKM keys with TPM public keys, and wherein the DKM keys when not in use are stored as encrypted by the TPM public keys, and wherein the DKM keys, when decrypted, are used by the cryptography software components of the DKM clients to encrypt and decrypt data, and wherein the decrypted DKM keys are accessible in clear form in memory of the DKM clients during encryption or decryption operations that use the decrypted DKM keys; creating a default DKM policy that applies to a plurality of DKM groups of the DKM system, wherein the default DKM policy specifies a set of cryptographic algorithms to protect data, a current DKM key to use in protect operations, and a lifetime of the current DKM key; and overriding the default DKM policy of the plurality of DKM groups by a different DKM policy for a particular DKM group of the plurality of DKM groups.