Patent ID: 7711122

Claim:
A method of accessing encrypted data, wherein the encrypted data is stored on a first secured system and a key usable for decrypting the encrypted data is stored on a second secured system and wherein the first secured system maintains a first private key of a first secured system key pair, the method comprising: obtaining a onetime key pair at the first secured system; generating a request by the first secured system for the key, wherein the request includes at least a onetime public key of the onetime key pair, wherein the onetime public, key is unknown to the second secured system prior to sending the request to the second secured system; signing the request with the first private key of the first secured system; sending the request signed by the first private key to the second secured system, wherein the second secured system is a key server; at the key server, obtaining the key from among a plurality of stored keys; responding to the request signed by the first private key with a response from the second secured system, wherein the response includes at least the key requested by the first secured system, encrypted using the onetime public key provided in the request signed by the first private key; decrypting at least a part of the response using the one-time private key, so as to obtain the key; using at least the key provided as part of the response to decrypt the encrypted data; and deleting, at the first secured system, the key obtained from the key server, once access to the encrypted data is complete for a given session, such that the key is not maintained at the first secured system.