Systems and methods for establishing and using distributed key servers

A licensing authority server for securely providing an authorization code to a requesting device, the licensing authority server comprising:

• a CPU;
• a memory that stores an encrypted secret key for at least a selected device;
• a server secret key store that is inaccessible to devices other than the CPU;
• and one or more input/output (I/O) ports;
• wherein the licensing authority server is capable of functioning as an “A” server in which
• in response to receiving a device authorization code request for the identified device via the one or more I/O ports, the CPU generates a server authorization code request and outputs the server authorization code request via the one or more I/O ports
• in response to receiving a server authorization code, the CPU generates an ephemeral global key, decrypts the encrypted secret key for the identified device with the ephemeral global key, generates a device authorization code for the identified device, and outputs the device authorization code for the identified device;
• and wherein the device authorization code for the identified device can be generated by the CPU only after receiving the server authorization code.

A computer program product comprising a non-transitory computer readable medium containing one or more instructions executable by a computer to perform steps including:

• functioning as an “A” server, including
• in response to receiving a device authorization code request from an identified device, generating a server authorization code request and outputting the server authorization code request,
• in response to receiving a server authorization code responsive to the server authorization code request, generating an ephemeral global key, decrypting an encrypted secret key for the identified device with the ephemeral global key, generating a device authorization code for the identified device, and outputting the device authorization code for the identified device, and
• inhibiting generation of the device authorization code for the identified device until the server authorization code is received.