Patent ID: 8850227

Claim:
A method for performing a cryptographic operation, the method comprising: submitting a request, to a security device, for a decrypted user encryption key, wherein the security device is configured to decrypt the user encryption key by unbinding the user encryption key using a user authorization key; receiving, outside the security device and in response to the submitted request, the decrypted user encryption key; decrypting, outside the security device, authorization data for a cryptographic key stored inside the security device using the decrypted user encryption key; submitting a request for the security device to load the cryptographic key, wherein the decrypted authorization data is used to authorize the request; submitting a request for the security device to perform a cryptographic operation using the loaded cryptographic key, wherein the security device is a trusted platform module (TPM) device; and prior to submitting the request for the decrypted user encryption key: submitting a request for the security device to load a storage root key, wherein the storage root key is a parent key of the user authorization key in a key hierarchy and the cryptographic key; and submitting a request for the security device to load the user authorization key that is configured to be decrypted by the storage root key, wherein the request to load the user authorization key includes authorization data for the user authorization key.