Patent ID: 8280043

Claim:
A processor-implemented method of protecting data in a secure system, comprising: generating a backup key; encrypting a plurality of secrets by the backup key; generating a distribution n plan for distributing a plurality of cryptographic splits of the backup key to a plurality of clients, wherein the distribution plan includes geographic and organizational diversity, and wherein the distribution plan specifies a first predetermined number, M, of the cryptographic splits to be generated and a second predetermined number, N, of the cryptographic splits required to recover the backup key; generating the M number of the cryptographic splits; distributing the M number of the cryptographic splits according to the distribution plan; utilizing the backup key to protect the secrets during a plurality of system processes; utilizing an init file to store secrets that are not changed recurrently; generating a session key to encrypt the init file, wherein the session key is randomly generated; using the backup key to encrypt the session key; utilizing a state file to record parameters that can change with each transaction; and encoding the state file by the backup key.