Patent ID: 8050407

Claim:
A method of protecting a media key comprising: obtaining, by a key management station (KMS) comprising a first processor, the media key, a media key identification, and an auxiliary key, wherein the media key identification identifies the media key; calculating, by the KMS, a split key using the media key and the auxiliary key; encrypting, by the KMS, the split key using a wrap key to generate an encrypted split key; encrypting, by the KMS, the media key identification to obtain an encrypted media key identification; assembling, by the KMS, a data bundle comprising the encrypted media key identification and the encrypted split key; storing the data bundle and a communication key on a token comprising a second processor, wherein the token is separate from the KMS; encrypting, by the token, the data bundle using the communication key to obtain an encrypted data bundle; and sending, from the token, the encrypted data bundle to a storage device comprising a third processor, wherein the storage device is separate from the KMS and the token, wherein the storage device is removably connected to a network, and wherein the storage device comprises a non-volatile memory and a volatile memory, wherein the media key and the media key identification are extracted from the encrypted data bundle by the storage device, wherein, upon extracting the media key and the media key identification form the encrypted data bundle, the storage device generates an encrypted data item using the media key and the media identification key, and wherein the storage device stores the encrypted data item and the media key identification in the non-volatile memory, and wherein the storage device stores the media key in the volatile memory so that the media key is erased if the storage device is disconnected from the network.