Derived unique recovery keys per session

A security protocol server, comprising:

• a network interface;
• and
• a processing circuit configured to:
• generate a recovery key from a first initial key based on a recovery key sequence number, the recovery key generated by performing operations comprising:
• executing a first one-way function one or more times with a previous internal key as input to determine an internal key, wherein the previous internal key is determined by executing the first one-way function one or more times with the first initial key as input, the previous internal key comprising an output of the first one-way function for a previous secure session;
• and
• executing a second one-way function with the internal key as input to determine the recovery key;
• and
• encrypt an object with the recovery key to generate an encrypted object.

A non-transitory computer-readable medium of a security protocol server storing computer-readable instructions such that, when executed, causes a processor to:

• generate a recovery key from a first initial key based on a recovery key sequence number, the recovery key generated by performing operations comprising:
• executing a first one-way function one or more times with a previous internal key as input to determine an internal key, wherein the previous internal key is determined by executing the first one-way function one or more times with the first initial key as input, the previous internal key comprising an output of the first one-way function for a previous secure session;
• and
• executing a second one-way function with the internal key as input to determine the recovery key;
• and
• encrypt an object with the recovery key to generate an encrypted object.

A method for recovering an object associated with a secure session established by a security protocol server, the method comprising:

• generating, by a recovery server, a recovery key based on a first initial key and a recovery key sequence number, the recovery key determined by performing operations comprising:
• executing a first one-way function one or more times with a previous internal key as input to determine an internal key, wherein the previous internal key is determined by executing the first one-way function one or more times with the first initial key as input, the previous internal key comprising an output of the first one-way function for a previous secure session;
• and
• executing a second one-way function with the internal key as input to determine the recovery key;
• and
• decrypting, by the recovery server, an encrypted object using the recovery key to generate the object associated with the secure session.

A recovery server, comprising:

• a network interface;
• and
• a processing circuit configured to:
• generate a recovery key based on a first initial key and a recovery key sequence number, wherein the recovery key is determined by performing operations comprising:
• executing a first one-way function one or more times with a previous internal key as input to determine an internal key, wherein the previous internal key is determined by executing the first one-way function one or more times with the first initial key as input, the previous internal key comprising an output of the first one-way function for a previous secure session;
• and
• executing a second one-way function with the internal key as input to determine the recovery key;
• and
• decrypt an encrypted object using the recovery key to generate a decrypted object associated with the secure session.

A non-transitory computer-readable medium of a recovery server storing computer-readable instructions such that, when executed, causes a processor to:

• generate a recovery key based on a first initial key and a recovery key sequence number, wherein the recovery key is determined by performing operations comprising:
• executing a first one-way function one or more times with a previous internal key as input to determine an internal key, wherein the previous internal key is determined by executing the first one-way function one or more times with the first initial key as input, the previous internal key comprising an output of the first one-way function for a previous secure session;
• and
• executing a second one-way function with the internal key as input to determine the recovery key;
• and
• decrypt an encrypted object using the recovery key to generate a decrypted object associated with the secure session.