Patent ID: 8064605

Claim:
A method for migrating a digital key, the method comprising: in a processing system including a processor, at least one mass storage device and a network interface controller, and having a first configuration, creating, via an application, a first configuration key having a binding to the first configuration as a descendant of a trusted platform module (TPM) storage root key (SRK) in the processing system; creating, via the application, a root user key as a descendant of the first configuration key, the root user key being a certified migratable key having no binding and associated with an upgrade authority of a second processing system external to the processing system and coupled to the processing system via the network interface controller; after the processing system has changed to a second configuration, creating, via the application, a second configuration key having a binding to the second configuration as a descendant of the SRK; thereafter sending a request to the upgrade authority for approval to migrate the root user key to the second configuration key; in response to receiving the approval from the upgrade authority, migrating the root user key to be a descendant of the second configuration key instead of the first configuration key; and creating, via the application, a first recovery configuration key having a password and not having a binding to either the first or second configuration and as a descendant of the SRK, and migrating the root user key to be loaded by the first recovery configuration key in a recovery environment of the processing system after an operating system failure, responsive to input of the password.