Cryptographic Lock-And-Key Generation, Distribution, and Validation

A method, comprising:

• generating a key request for a key to access a resource;
• providing the key request to a key control device;
• receiving a recipient envelope from the key control device based on providing the key request, wherein the recipient envelope comprising a first encryption of the key representing a key envelope encrypted with a private key of the key control device and a second encryption of the key envelope encrypted with a public key of a recipient or a server;
• delivering the recipient envelope to the recipient when the second encryption is based on the public key of the recipient;
• and
• delivering a different recipient envelope to the recipient when the second encryption is based on the server public key, wherein the different recipient envelope comprising the key envelope that is encrypted with the public key of the recipient.
• wherein the recipient subsequently providing the key envelope to the key control device for obtaining access to the resource.

A system, comprising:

• a key control device comprising a secure processor and a secure non-transitory computer-readable storage medium;
• the secure non-transitory computer-readable storage medium comprising secure executable instructions;
• a server comprising a processor and a non-transitory computer-readable storage medium;
• the non-transitory computer-readable storage medium comprising executable instructions;
• the secure executable instructions when executed by the secure processor from the secure non-transitory computer readable storage medium cause the secure processor to perform first operations comprising:
• generating a key for access to a resource based on a key request received from the server;
• encrypting the key with a private key of the key control device producing a key envelope;
• encrypting the key envelope with a public key of a recipient producing a recipient envelope;
• receiving the key envelope from the recipient;
• decrypting the key envelope with the private key of the key control device producing the key;
• and
• processing on behalf of or issuing a command to the resource based on decrypting the key envelope received from the recipient and producing the key;
• the executable instructions when executed by the processor from the non-transitory computer-readable storage medium cause the processor to perform second operations comprising:
• generating the key request based on the recipient and the resource;
• providing the key request to the key control device with the public key of the recipient;
• receiving the recipient envelope from the key control device based on providing the key request;
• and
• delivering the recipient envelope to a recipient device associated with the recipient.