Patent ID: 8495380

Claim:
A method comprising: transmitting, by a computer system, a request for a subject key pair; receiving by the computer system, in response to the request, a subject private key that has been encrypted with a session key, and a subject public key; transmitting to a token, by the computer system, (i) the encrypted subject private key, and (ii) the session key encrypted with a symmetric key that is based on the token and a master key; transmitting to a certificate authority, by the computer system, a certificate enrollment request with information pertaining to the subject public key; receiving, by the computer system, a certificate in response to the certificate enrollment request; generating a storage session key; encrypting the subject private key with the storage session key; retrieving a storage private key; encrypting the storage session key with the storage private key; and storing (i) the subject private key encrypted with the storage session key, and (ii) the encrypted storage session key.