Redundant key server encryption environment

A computer program product implemented in a device to communicate with at least two key servers and to obtain an encryption key, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that executes to perform operations, the operations comprising:

• sending an encryption key request for an encryption key to use to a selected key server comprising one of the at least two key servers;
• receiving, from the selected key server, a first wrapped encryption key comprising an encryption key encrypted with a device public key for which the device has a device private key to decrypt data encrypted with the device public key, a second wrapped encryption key comprising the encryption key encrypted with a public key for which the selected key server maintains a corresponding private key, and at least one additional wrapped encryption key encrypted with a public key for which the key server other than the selected key server has a corresponding key server private key;
• and
• decrypting the first wrapped encryption key to obtain the encryption key decrypted to use for encryption operations.

A system in communication with at least one device and at least one remote key server, comprising:

• a computer readable storage medium having a key store including public keys;
• a key manager in communication with the computer readable storage medium and executing instructions to perform operations, the operations comprising:
• transmitting the public keys in the key store associated with the key server and at least one device to at least one remote key server, wherein the transmitted public keys are associated with the key manager and the at least one device;
• receiving from the at least one remote key server public keys associated with the at least one remote key server;
• receiving a request for an encryption key from a requesting device comprising one of the at least one device;
• generating the encryption key for use by the requesting device to unlock a storage;
• generating a first wrapped encryption key by encrypting the encryption key with a requesting device public key associated with the requesting device;
• generating a second wrapped encryption key by encrypting the encryption key with a public key associated with the key server;
• generating at least one additional wrapped encryption key for each of the at least one remote key server by encrypting the encryption key with the at least one public key provided by the at least one remote key server;
• and
• transmitting, to the requesting device, the first, second and the at least one additional wrapped encryption key to the requesting device.

A system in communication with at least two key servers for obtaining an encryption key, comprising:

• a computer readable storage medium having a storage encryption manager executed to perform operations, the operations comprising:
• sending an encryption key request for an encryption key to use to a selected key server comprising one of the at least two key servers;
• receiving, from the selected key server, a first wrapped encryption key comprising an encryption key encrypted with a device public key for which the device has a device private key to decrypt data encrypted with the device public key, a second wrapped encryption key comprising the encryption key encrypted with a public key for which the selected key server maintains a corresponding private key, and at least one additional wrapped encryption key encrypted with a public key for which the key server other than the selected key server has a corresponding key server private key;
• and
• decrypting the first wrapped encryption key to obtain the encryption key decrypted to use for encryption operations.