Secure distributed storage of encryption keys

A system for cryptographic processing comprising:

• a network;
• a client computing device communicatively connected to the network;
• and
• a server computing device communicatively connected to the network, the server computing device configured to:
• securely maintain a set of correspondences between encryption keys and key identifiers, wherein securely maintaining the set of correspondences between encryption keys and key identifiers includes:
• receiving a key request from the client computing device across the network, the key request including a key identifier from the client computing device and credentials of the client computing device, the key request not including any data to be cryptographically processed;
• in response to receiving the key request, authenticating the credentials of the client computing device;
• in response to successfully authenticating the credentials of the client computing device from the key request, generating an encryption key to be associated with the key identifier from the key request;
• and
• in response to generating the encryption key, storing the encryption key in a secure vault, access to the encryption key within the secure vault requiring the associated key identifier and credentials of the client computing device;
• receive, subsequent to storing the encryption key in the secure vault, a cryptographic request from the client computing device across the network, the cryptographic request including the credentials, data to be cryptographically processed, and the key identifier to be used for cryptographic processing;
• and
• in response to successfully authenticating the cryptographic request:
• obtain, with reference to the set of correspondences, the encryption key corresponding to the key identifier and verify that the client computing device has permission to use the encryption key corresponding to the received key identifier, including accessing the secure vault using the key identifier and the credentials from the cryptographic request;
• cryptographically process the received data using the obtained encryption key to generate cryptographically-processed data;
• and
• send the cryptographically-processed data across the network to the client computing device;
• wherein the client computing device is configured to:
• send the key request and the cryptographic request to the server computing device across the network;
• receive the cryptographically-processed data from the server computing device across the network;
• and
• make use of the received cryptographically-processed data;
• and
• wherein the encryption key is maintained securely within the server computing device without being transmitted over the network.

A computer program product comprising a non-transitory computer-readable storage medium storing a set of instructions, which, when executed by a computing device, cause the computing device to:

• securely maintain a set of correspondences between encryption keys and key identifiers, wherein securely maintaining the set of correspondences between encryption keys and key identifiers includes:
• receiving a key request from a remote device across a network, the key request including a key identifier from the remote device and credentials of the remote device, the key request not including any data to be cryptographically processed;
• in response to receiving the key request, authenticating the credentials of the remote device;
• in response to successfully authenticating the credentials of the remote device from the key request, generating an encryption key to be associated with the key identifier from the key request;
• and
• in response to generating the encryption key, storing the encryption key in a secure vault, access to the encryption key within the secure vault requiring the associated key identifier and credentials of the remote device;
• receive, subsequent to storing the encryption key in the secure vault, a cryptographic request from the remote device across the network, the cryptographic request including the credentials, data to be cryptographically processed, and the key identifier to be used for cryptographic processing;
• and
• in response to successfully authenticating the cryptographic request:
• obtain, with reference to the set of correspondences, the encryption key corresponding to the key identifier and verify that the remote device has permission to use the encryption key corresponding to the received key identifier, including accessing the secure vault using the key identifier and the credentials from the cryptographic request;
• cryptographically process the received data using the obtained encryption key to generate cryptographically-processed data;
• and
• send the cryptographically-processed data across the network to the remote device;
• wherein the encryption key is maintained securely within the computing device without being transmitted over the network.