System and method for protecting master encryption keys

A non-transitory computer-readable storage medium upon which a plurality of instructions is stored, the instructions for causing a first computing device to perform the steps of a method of protecting master transport encryption keys stored on the first computing device, wherein at least one master transport encryption key is used to secure confidentiality of data communications between the first computing device and a second computing device, wherein data to be stored on the first computing device is encryptable using a content protection key when a content protection mode is enabled on the first computing device, wherein the method comprises:

• generating a copy of a single grand master encryption key in decrypted form;
• encrypting each individual encryption key of the at least one master transport encryption key using the grand master encryption key;
• storing each individual encryption key encrypted using the grand master encryption key in a non-volatile store;
• storing the copy of the single grand master encryption key in decrypted form in a volatile store;
• and
• when the first computing device is locked using the device password to prevent unauthorized use thereof while the content protection mode is enabled, retaining the copy of the single grand master encryption key in decrypted form in the volatile store for use in decrypting at least one of the individual encryption keys, encrypted using the grand master encryption key, to decrypt data received at the first computing device from the second computing device while the first computing device is locked.

A system for protecting master transport encryption keys stored on a first computing device, the system comprising the first computing device and a second computing device, wherein at least one master transport encryption key is used to secure confidentiality of data communications between the first computing device and the second computing device, and wherein data to be stored on the first computing device is encryptable using a content protection key when a content protection mode is enabled on the first computing device, and wherein a processor of the first computing device is configured to:

• generate a copy of a single grand master encryption key in decrypted form;
• encrypt each individual encryption key of the at least one master transport encryption key using the grand master encryption key;
• store each individual encryption key encrypted using the grand master encryption key in a non-volatile store;
• store the copy of the single grand master encryption key in decrypted form in a volatile store;
• and
• when the first computing device is locked using the device password to prevent unauthorized use thereof while the content protection mode is enabled, retain the copy of the single grand master encryption key in decrypted form in the volatile store for use in decrypting at least one of the individual encryption keys, encrypted using the grand master encryption key, to decrypt data received at the first computing device from the second computing device while the first computing device is locked.