Authenticated copying of encryption keys between secure zones

1. A computer-implemented method comprising:

transferring, by one or more processors, security credentials stored on a smart key card associated with a first entity having a first subset level of permission that allows the first entity access to a first zone to a smart key card of a second entity that does not have the security credentials associated with the first subset level of permission for a specified time period and purpose while maintaining security credentials of the second entity that are already stored on the smart key card of the second entity and maintaining the security credentials of the first entity on the smart key card of the first entity by:

creating a temporary file based on security credentials of the first entity and transferring the temporary file that includes the security credentials of the first entity.

2. The computer-implemented method of claim 1 , further comprising:

responsive to receiving a request to share security credentials between two entities, enrolling, by one or more processors, respective security credentials associated with a first and a second entity, wherein each security credential specifies different levels of permission for the first and the second entity.

3. The computer-implemented method of claim 1 , wherein enrolling, by one or more processors, respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission comprises:

receiving, by one or more processors, a token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with a first subset level of permission of accessing a first zone;

decrypting, by one or more processors, the data associated with the first subset level of permission; and

encrypting, by one or more processors, the data associated with the first subset level of permission using the identified key-encrypting-key.

4. The computer-implemented method of claim 3 , further comprising:

writing, by one or more processors, the encrypted data to a temporary file.

5. The computer-implemented method of claim 4 , further comprising:

establishing, by one or more processors, a secure connection between the first entity having security credentials associated with the first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission.

6. The computer-implemented method of claim 5 , further comprising:

retrieving, by one or more processors, the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first subset level of permission; and

sending, by one or more processors, the encrypted data to the second entity.

7. The computer-implemented method of claim 6 , further comprising:

responsive to decrypting the encrypted data, enabling, by one or more processors, temporary access to the security credentials associated with the first subset level of permission.

8. A computer program product comprising:

a computer readable storage medium and program instructions stored on the computer readable storage medium, the program instructions comprising:

program instructions to transfer security credentials stored on a smart key card associated with a first entity having a first subset level of permission that allows the first entity access to a first zone to a smart key card of a second entity that does not have the security credentials associated with the first subset level of permission by

creating a temporary file based on security credentials of the first entity and transferring the temporary file that includes the security credentials of the first entity, wherein the temporary file includes instructions to persist for a specified time period and purpose while maintaining security credentials of the second entity that are already stored on the smart key card of the second entity and maintaining the security credentials of the first entity on the smart key card of the first entity.

9. The computer program product of claim 8 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to, responsive to receiving a request to share security credentials between two entities, enroll respective security credentials associated with a first and a second entity, wherein each security credential specifies different levels of permission for the first and the second entity.

10. The computer program product of claim 8 , wherein the program instructions to enroll respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission comprise:

program instructions to receive token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with a first subset level of permission of accessing a first zone;

program instructions to decrypt the data associated with the first subset level of permission; and

program instructions to encrypt the data associated with the first subset level of permission using the identified key-encrypting-key.

11. The computer program product of claim 10 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to write the encrypted data to a temporary file.

12. The computer program product of claim 11 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to establish a secure connection between the first entity having security credentials associated with the first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission.

13. The computer program product of claim 12 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to retrieve the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first subset level of permission; and

program instructions to send the encrypted data to the second entity.

14. The computer program product of claim 13 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to, responsive to decrypting the encrypted data, enable temporary access to the security credentials associated with the first subset level of permission.

15. A computer system, comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:

program instructions to transfer security credentials stored on a smart key card associated with a first entity having a first subset level of permission that allows the first entity access to a first zone to a smart key card of a second entity that does not have the security credentials associated with the first subset level of permission by

creating a temporary file based on security credentials of the first entity and transferring the temporary file that includes the security credentials of the first entity, wherein the temporary file includes instructions to persist for a specified time period and purpose while maintaining security credentials of the second entity that are already stored on the smart key card of the second entity and maintaining the security credentials of the first entity on the smart key card of the first entity.

16. The computer system of claim 15 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to, responsive to receiving a request to share security credentials between two entities, enroll respective security credentials associated with a first and a second entity, wherein each security credential specifies different levels of permission for the first and the second entity.

17. The computer system of claim 15 , wherein the program instructions to enroll respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission comprise:

program instructions to receive token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with a first subset level of permission of accessing a first zone;

program instructions to decrypt the data associated with the first subset level of permission; and

program instructions to encrypt the data associated with the first subset level of permission using the identified key-encrypting-key.

18. The computer system of claim 17 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to write the encrypted data to a temporary file.

19. The computer system of claim 18 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to establish a secure connection between the first entity having security credentials associated with the first subset level of permission and the second entity that does not have the security credentials associated with the first subset level of permission.

20. The computer system of claim 19 , wherein the program instructions stored on the one or more computer readable storage medium further comprise:

program instructions to retrieve the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first subset level of permission; and

program instructions to send the encrypted data to the second entity.