Data encryption key management system

An Information Handling System (IHS), comprising:

• a processing system;
• and
• a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a Baseboard Management Controller (BMC) engine that is configured to:
• receive, from a key management agent included in a host operating system provided on a computing system, a first stored data encryption key generated by a hypervisor provided on the computing system for a virtual machine provided on the computing system;
• store the first stored data encryption key in a key vault provided by a BMC storage device included in the computing system;
• receive, from the key management agent subsequent to storing the first stored data encryption key in the key vault provided by the BMC storage device, a stored data encryption key request;
• and
• retrieve, in response to receiving the stored data encryption key request, the first stored data encryption key from the key vault provided by the BMC storage device, and transmit the first stored data encryption key to the key management agent.

A method for managing data encryption keys, comprising:

• receiving, by a Baseboard Management Controller (BMC) device included in a computing system from a key management agent included in a host operating system provided on the computing system, a first stored data encryption key generated by a hypervisor provided on the computing system for a virtual machine provided on the computing system;
• storing, by the BMC device, the first stored data encryption key in a key vault provided by a BMC storage device included in the BMC device;
• receiving, by the BMC device from the key management agent subsequent to storing the first stored data encryption key in the key vault provided by the BMC storage device, a stored data encryption key request;
• and
• retrieving, by the BMC device in response to receiving the stored data encryption key request, the first stored data encryption key from the key vault provided by the BMC storage device, and transmitting the first stored data encryption key to the key management agent.