| CPC H04L 9/0822 (2013.01) [H04L 9/0877 (2013.01); H04L 9/0891 (2013.01); H04L 9/14 (2013.01)] | 20 Claims |

|
1. A method for providing multiple key encryption, comprising:
generating, a private key encryption key (KEK) and a corresponding public KEK in a trusted execution environment (TEE);
providing the public KEK to a key generator;
generating, by the key generator, a data encryption key (DEK) and encrypting the DEK with the public KEK;
obtaining, by a key processor, an ephemeral public key and the encrypted DEK, and sending the ephemeral public key and the encrypted DEK to the TEE;
decrypting, by the TEE, the encrypted DEK using the private KEK, and re-encrypting the decrypted DEK with the ephemeral public key;
obtaining, by the key processor, the re-encrypted DEK from the TEE and passing the re-encrypted DEK to a signing service;
decrypting, by the signing service the re-encrypted DEK using a corresponding ephemeral private key; and
encrypting, by the signing service, data using the DEK.
|