System, method, and computer program product for sensitive data recovery in high security systems

1. A computer implemented method, comprising:

receiving, on a client device, a request by a user to initiate a data recovery process to recover data that is encrypted;

generating, by the client device, a new data recovery request key pair;

creating, by the client device, a data recovery request that includes a data recovery request public key;

signing, by the client device, the data recovery request using an identity private key that is associated with a certificate issued by a certification authority (CA);

sending, by the client device, the data recovery request to a server system storing the data;

accessing, by the server system, an offline data recovery subsystem (ODRS) storing a data recovery key pair to authenticate the user;

generating and storing, by the ODRS, a secret data recovery code, wherein the secret data recovery code is communicated to the user;

receiving, by the client device, the secret data recovery code that was communicated to the user;

sending, by the client device, the secret data recovery code along with the data recovery request to the server system;

verifying, by the server system, the received secret data recovery code against the generated and stored secret data recovery code;

verifying, by the server system, a public key associated with the received data recovery request against a public key associated with a stored recovery request;

identifying, by the server system, the data recovery request as authenticated;

verifying, by the ODRS, a request signature associated with the data recovery request;

verifying, by the ODRS, an encrypted signature against encrypted and signed recovery data;

verifying, by the ODRS, that a user ID in a password reset request matches a user ID in a message encryption key signature;

decrypting, by the ODRS, the data recovery key pair and re-encrypting the data recovery key pair to the data recovery request public key;

storing, by the ODRS, the re-encrypted data recovery key pair associated with the data recovery request;

querying, by the client device, the server system to obtain the data;

returning, by the server system, the data to the client device; and

decrypting, by the client device, the data using a data recovery private key.

2. The method of claim 1 , wherein the user chooses a new password utilizing the client device that will protect the data after the data has been recovered.

3. The method of claim 1 , wherein the user generates a new data protection secret utilizing the client device that will protect the data after the data has been recovered.

4. The method of claim 1 , wherein the ODRS utilizes a hardware security module for verifying the request signature associated with the data recovery request.

5. The method of claim 1 , wherein the ODRS utilizes a hardware security module for verifying the encrypted signature against the encrypted and signed recovery data.

6. The method of claim 1 , wherein the ODRS is not connected to a network.

7. The method of claim 1 , wherein the certificate issued by the certification authority includes a public key infrastructure (PKI) certificate.

8. A non-transitory computer readable medium storing computer code executable by a processor to perform a method comprising:

receiving, on a client device, a request by a user to initiate a data recovery process to recover data that is encrypted;

generating, by the client device, a new data recovery request key pair;

creating, by the client device, a data recovery request that includes a data recovery request public key;

signing, by the client device, the data recovery request using an identity private key that is associated with a certificate issued by a certification authority (CA);

sending, by the client device, the data recovery request to a server system storing the data;

accessing, by the server system, an offline data recovery subsystem (ODRS) storing a data recovery key pair to authenticate the user;

generating and storing, by the ODRS, a secret data recovery code, wherein the secret data recovery code is communicated to the user;

receiving, by the client device, the secret data recovery code that was communicated to the user;

sending, by the client device, the secret data recovery code along with the data recovery request to the server system;

verifying, by the server system, the received secret data recovery code against the generated and stored secret data recovery code;

verifying, by the server system, a public key associated with the received data recovery request against a public key associated with a stored recovery request;

identifying, by the server system, the data recovery request as authenticated;

verifying, by the ODRS, a request signature associated with the data recovery request;

verifying, by the ODRS, an encrypted signature against encrypted and signed recovery data;

verifying, by the ODRS, that a user ID in a password reset request matches a user ID in a message encryption key signature;

decrypting, by the ODRS, the data recovery key pair and re-encrypting the data recovery key pair to the data recovery request public key;

storing, by the ODRS, the re-encrypted data recovery key pair associated with the data recovery request;

querying, by the client device, the server system to obtain the data;

returning, by the server system, the data to the client device; and

decrypting, by the client device, the data using a data recovery private key.

9. The non-transitory computer readable medium of claim 8 , wherein the user chooses a new password utilizing the client device that will protect the data after the data has been recovered.

10. The non-transitory computer readable medium of claim 8 , wherein the user generates a new data protection secret utilizing the client device that will protect the data after the data has been recovered.

11. The non-transitory computer readable medium of claim 8 , wherein the ODRS utilizes a hardware security module for verifying the request signature associated with the data recovery request.

12. The non-transitory computer readable medium of claim 8 , wherein the ODRS utilizes a hardware security module for verifying the encrypted signature against the encrypted and signed recovery data.

13. The non-transitory computer readable medium of claim 8 , wherein the ODRS is not connected to a network.

14. The non-transitory computer readable medium of claim 8 , wherein the certificate issued by the certification authority includes a public key infrastructure (PKI) certificate.

15. A system, comprising processor and memory for:

receiving, on a client device, a request by a user to initiate a data recovery process to recover data that is encrypted;

generating, by the client device, a new data recovery request key pair;

creating, by the client device, a data recovery request that includes a data recovery request public key;

signing, by the client device, the data recovery request using an identity private key that is associated with a certificate issued by a certification authority (CA);

sending, by the client device, the data recovery request to a server system storing the data;

accessing, by the server system, an offline data recovery subsystem (ODRS) storing a data recovery key pair to authenticate the user;

generating and storing, by the ODRS, a secret data recovery code, wherein the secret data recovery code is communicated to the user;

receiving, by the client device, the secret data recovery code that was communicated to the user;

sending, by the client device, the secret data recovery code along with the data recovery request to the server system;

verifying, by the server system, the received secret data recovery code against the generated and stored secret data recovery code;

verifying, by the server system, a public key associated with the received data recovery request against a public key associated with a stored recovery request;

identifying, by the server system, the data recovery request as authenticated;

verifying, by the ODRS, a request signature associated with the data recovery request;

verifying, by the ODRS, an encrypted signature against encrypted and signed recovery data;

verifying, by the ODRS, that a user ID in a password reset request matches a user ID in a message encryption key signature;

decrypting, by the ODRS, the data recovery key pair and re-encrypting the data recovery key pair to the data recovery request public key;

storing, by the ODRS, the re-encrypted data recovery key pair associated with the data recovery request;

querying, by the client device, the server system to obtain the data;

returning, by the server system, the data to the client device; and

decrypting, by the client device, the data using a data recovery private key.

16. The system of claim 15 , wherein the user chooses a new password utilizing the client device that will protect the data after the data has been recovered.

17. The system of claim 15 , wherein the user generates a new data protection secret utilizing the client device that will protect the data after the data has been recovered.

18. The system of claim 15 , wherein the ODRS utilizes a hardware security module for verifying the request signature associated with the data recovery request.

19. The system of claim 15 , wherein the ODRS utilizes a hardware security module for verifying the encrypted signature against the encrypted and signed recovery data.

20. The system of claim 15 , wherein the ODRS is not connected to a network.