Patent ID: 8064604

Claim:
A method for facilitating role-based cryptographic key management, the method comprising: receiving a request at a computer system from a first user to perform a cryptographic operation, wherein the first user is a member of a first role, and the first role is a member of a second role that has been granted permission to perform the cryptographic operation, and wherein a second role key associated with the second role is wrapped with a first role key associated with the first role; receiving a user secret to unwrap a first user key associated with the first user; using the first user key to unwrap the first role key; using the first role key to unwrap the second role key; using the second role key to unwrap a data key and a permission, wherein the data key is a column key used to perform cryptographic operations on a column, a row, or a cell, within a database, and wherein the permission specifies cryptographic operations applicable to the second role; and responsive to the applicable permission, using the data key to perform the cryptographic operation.