Patent ID: 7443985

Claim:
A method for providing secure server key operations in a system comprising a front-end server that is accessible via a global communications network and a back-end server that is coupled to the front-end server via a local communications network, the method comprising: generating, on the front-end server, a certificate signing public-private key pair for use in connection with signing a certificate, wherein the certificate signing public-private key pair includes a certificate signing public key and a certificate signing private key; generating a content protection public-private key pair for use in connection with encrypting or decrypting a piece of digital content, wherein the content protection public-private key pair includes a content protection public key and a content protection private key; storing the certificate signing private key on the front-end server; storing the content protection private key on the back-end server so as to avoid such content protection private key from being directly accessible via the global communications network; and providing to a client application, a certificate chain that includes the certificate signing public key and the content protection public key.