Optimizing use of hardware security modules

A computer readable storage memory device for optimizing use of cryptographic key-store hardware security modules comprising:

• one or more tangible, computer-readable storage memory devices;
• and
• first program instructions for causing a processor to secure at least one cryptographic key in a hardware storage module;
• second program instructions for, responsive to a first trigger being met, causing a processor to:
• reclassify the cryptographic key;
• generate a key-encrypting-key;
• and
• encrypt the cryptographic key using the key-encrypting-key;
• third program instructions for causing a processor to, responsive to the reclassifying, free memory space occupied in the hardware security module by the cryptographic key by relocating the encrypted cryptographic key into a soft key store;
• and
• fourth program instructions for causing a processor to, subsequent to the relocating and responsive to a request to access data secured by the cryptographic key:
• decrypt the encrypted cryptographic key in the soft key store while retaining the cryptographic key in the soft key store;
• and
• use the decrypted cryptographic key to provide access to secured data per the request;
• wherein a security certification level of the hardware security module is greater than a security certification level of the soft key store.

A system for optimizing use of cryptographic key-store hardware security modules comprising:

• one or more computer microprocessors;
• and
• one or more tangible, computer-readable storage memory devices, encoding program instructions for causing the processor to perform operations of:
• securing by a processor at least one cryptographic key in a hardware security module;
• responsive to a first trigger being met:
• reclassifying, by a processor, the cryptographic key;
• generating, by a processor, a key-encrypting-key;
• and
• encrypting, by a processor, the cryptographic key using the key-encrypting-key;
• responsive to the reclassifying, freeing memory space occupied in the hardware security module by the cryptographic key by relocating, by a processor, the encrypted cryptographic key into a soft key store;
• and
• subsequent to the relocating and responsive to a request to access data secured by the cryptographic key:
• decrypting by a processor the encrypted cryptographic key in the soft key store while retaining the cryptographic key in the soft key store;
• and
• using by a processor the decrypted cryptographic key to provide access to secured data per the request;
• wherein a security certification level of the hardware security module is greater than a security certification level of the soft key store.