Patent ID: 7779258

Claim:
A data structure stored on a non-transitory computer readable storage medium, the data structure comprising instructions that are cryptographically protected against alteration or misuse, wherein said instructions further comprise a trusted block that defines specific key management policies that are permitted when applications employ said trusted block to generate, import, or export symmetric cryptographic keys, and wherein said applications comprise: application programming interfaces (API); embedded firmware; operating system code; and hardware configured operations; and wherein said applications further comprise: a Trusted_Block_Create (TBC) function; a Remote_Key_Export (RKX) function; and wherein said TBC function creates said trusted block; and wherein said RKX function uses said Trusted Block to generate, import or export symmetric keys according to a set of parameters in said Trusted Block; and wherein said RKX function creates a RKX token; and wherein said RKX token encases said keys; and wherein said trusted block has a field containing rules that provide an ability to limit how said trusted block is used, thereby reducing the risk of said trusted block being employed in unintended ways or with unintended keys; and wherein said rules are created and approved by a cryptographic module under the control of at least two separate individuals; wherein said trusted block is created with integrity protection by a message authentication code (MAC); and wherein said MAC is calculated over the contents of said trusted block; and wherein said trusted block comprises a randomly generated MAC key that is used to achieve said trusted blocks integrity protection; and wherein said MAC key and a prepended confounder is encrypted under a variant of said cryptographic modules master key.