Authenticated copying of encryption keys between secure zones

1. A method comprising:

responsive to receiving a request to share security credentials between two entities, enrolling, by one or more processors, respective security credentials associated with a first and a second entity, wherein each security credential specifies different levels of permission for the first and the second entity; and

transferring, by one or more processors, security credentials stored on a smart key card associated with the first entity having a first subset level of permission that allows the first entity access to a first zone to a smart key card of the second entity that does not have the security credentials associated with the first subset level of permission by creating a temporary file based on security credentials of the first entity and transferring the temporary file that includes the security credentials of the first entity, wherein

the temporary file includes instructions to persist for a specified time period and purpose and instructions to maintain the security credentials of the second entity that are already stored on the smart key card of the second entity and maintaining the security credentials of the first entity on the smart key card of the first entity.

2. The method of claim 1 , wherein enrolling, by one or more processors, respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission comprises:

receiving, by one or more processors, a token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with a first subset level of permission of accessing a first zone;

decrypting, by one or more processors, the data associated with the first subset level of permission; and

encrypting, by one or more processors, the data associated with the first subset level of permission using the identified key-encrypting-key.

3. The method of claim 2 , further comprising:

writing, by one or more processors, the encrypted data to a temporary file.

4. The method of claim 3 , further comprising:

establishing, by one or more processors, a secure connection between the first entity having security credentials associated with the first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission.

5. The method of claim 4 , further comprising:

retrieving, by one or more processors, the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first subset level of permission; and

sending, by one or more processors, the encrypted data to the second entity.

6. The method of claim 5 , further comprising:

responsive to decrypting the encrypted data, enabling, by one or more processors, temporary access to the security credentials associated with the first subset level of permission.

7. The method of claim 1 , further comprising:

in response to a request to transfer security credentials, establishing, by one or more processors, a secure connection between the first entity having security credentials associated with first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission; and

decrypting the encrypted data of the smart key card of the first entity on the smart key card of the second entity.

8. A computer program product comprising:

a computer readable storage medium and program instructions stored on the computer readable storage medium, the program instructions comprising:

responsive to receiving a request to share security credentials between two entities, program instructions to enroll respective security credentials associated with a first and a second entity, wherein each security credential specifies different levels of permission for the first and the second entity; and

program instructions to transfer security credentials stored on a smart key card associated with the first entity having a first subset level of permission that allows the first entity access to a first zone to a smart key card of the second entity that does not have the security credentials associated with the first subset level of permission by creating a temporary file based on security credentials of the first entity and transferring the temporary file that includes the security credentials of the first entity, wherein

the temporary file includes instructions to persist for a specified time period and purpose and instructions to maintain the security credentials of the second entity that are already stored on the smart key card of the second entity and maintaining the security credentials of the first entity on the smart key card of the first entity.

9. The computer program product of claim 8 , wherein program instructions to enroll respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission, comprising:

program instructions to receive a token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with a first subset level of permission of accessing a first zone;

program instructions to decrypt the data associated with the first subset level of permission; and

program instructions to encrypt the data associated with the first subset level of permission using the identified key-encrypting-key.

10. The computer program product of claim 9 , further comprising:

program instructions to write the encrypted data to a temporary file.

11. The computer program product of claim 10 , further comprising:

program instructions to establish a secure connection between the first entity having security credentials associated with the first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission.

12. The computer program product of claim 11 , further comprising:

program instructions to retrieve the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first subset level of permission; and

program instructions to send the encrypted data to the second entity.

13. The computer program product of claim 12 , further comprising:

responsive to decrypting the encrypted data, program instructions to enable temporary access to the security credentials associated with the first subset level of permission.

14. The computer program product of claim 8 , wherein the program instructions stored on the computer readable storage media further comprise:

program instructions to, in response to a request to transfer security credentials, establish a secure connection between the first entity having security credentials associated with first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission; and

program instructions to decrypt the encrypted data of the smart key card of the first entity on the smart key card of the second entity.

15. A computer system, comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:

responsive to receiving a request to share security credentials between two entities, program instructions to enroll respective security credentials associated with a first and a second entity, wherein each security credential specifies different levels of permission for the first and the second entity; and

program instructions to transfer security credentials stored on a smart key card associated with the first entity having a first subset level of permission that allows the first entity access to a first zone to a smart key card of the second entity that does not have the security credentials associated with the first subset level of permission by creating a temporary file based on security credentials of the first entity and transferring the temporary file that includes the security credentials of the first entity, wherein

the temporary file includes instructions to persist for a specified time period and purpose and instructions to maintain the security credentials of the second entity that are already stored on the smart key card of the second entity and maintaining the security credentials of the first entity on the smart key card of the first entity.

16. The computer system of claim 15 , wherein program instructions to enroll respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission, comprising:

program instructions to receive a token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with a first subset level of permission of accessing a first zone;

program instructions to decrypt the data associated with the first subset level of permission; and

program instructions to encrypt the data associated with the first subset level of permission using the identified key-encrypting-key.

17. The computer system of claim 16 , further comprising:

program instructions to write the encrypted data to a temporary file.

18. The computer system of claim 17 , further comprising:

program instructions to establish a secure connection between the first entity having security credentials associated with the first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission.

19. The computer system of claim 18 , further comprising:

program instructions to retrieve the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first subset level of permission; and

program instructions to send the encrypted data to the second entity; and

responsive to decrypting the encrypted data, program instructions to enable temporary access to the security credentials associated with the first subset level of permission.

20. The computer system of claim 15 , wherein the program instructions stored on the computer readable storage media further comprise:

program instructions to, in response to a request to transfer security credentials, establish a secure connection between the first entity having security credentials associated with first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission; and

program instructions to decrypt the encrypted data of the smart key card of the first entity on the smart key card of the second entity.