Information-centric security

A computer program product for encrypting/decrypting information, the computer program-product residing on a computer-readable medium and comprising computer-readable instructions configured to cause a computer to:

• receive a public portion of a label for key encryption and to receive a private portion of the label for key decryption, the label including an asymmetric key pair of the public and private portions;
• process the public portion and an ephemeral private key to obtain a key encryption key for information encryption and to process the private portion and an ephemeral public key to obtain the key encryption key for information decryption;
• for information encryption:
• receive a data encryption key from a random number generator;
• encrypt the data encryption key using the key encryption key to produce an encrypted data encryption key;
• and
• provide the encrypted data encryption key to an encryption device;
• and for information decryption:
• receive the key encryption key and an encrypted data encryption key associated with ciphertext;
• decrypt the data encryption key using the key encryption key to produce an unencrypted data encryption key;
• and
• provide the unencrypted data encryption key to a decryption device.

A cryptographic system for providing cryptographic key management, the system comprising:

• a communications interface configured to communicate electronically with a plurality of clients;
• a memory configured to store at least one of a public and a private portion of a cryptographic key pair associated with different levels of access;
• and
• a key management module configured and connected to communicate with the interface and the memory and configured to:
• split public and private portions of encryption keys into asymmetric pieces;
• provide access by clients through the communication interface to public and private portions of keys if the clients satisfy at least one authentication mechanism associated with a first security level at least as high as a second security level associated with the portions of keys that the client desires to access;
• and
• encrypt a data encryption key that is for use in encrypting a plaintext message.