User-initiated migration of encryption keys

1. A method, comprising:

storing a master key in a non-volatile memory;

using a communication circuit of a computing server,

authenticating a first network communication device in a data network using a first key, wherein the first key is derived from the master key and a first set of key derivation data stored on the first network communication device, and

receiving a data migration request from a second network communication device in the data network, the data migration request specifying the first set of key derivation data and specifying a second set of key derivation data stored at the second network communication device;

in response to receiving the data migration request, using a processing circuit of the computing server to

determine a temporary key used by the second network communication device based on the first and second sets of key derivation data and the master key, and

generate a second key based on the master key and the second set of key derivation data; and

using the communication circuit,

providing the second key to the second network communication device via a secure communication channel established using the temporary key, and

authenticating the second network communication device using the second key.

2. The method of claim 1 , further comprising:

using the communication circuit of the computing server, receiving the first set of key derivation data from the first network communication device in the data network connected to the communication circuit; and

using the processing circuit of the computing server, generating the first key based on the master key and the first set of key derivation data.

3. The method of claim 1 , wherein

the temporary key used by the second network communication device is generated by the first network communication device using the first key and the second set of key derivation data; and

the determining of the temporary key includes

deriving the first key from the first set of key derivation data in the data migration request and the master key, and

deriving the temporary key from the first key and the second set of key derivation data.

4. The method of claim 1 , further comprising

using the processing circuit, deriving the first key from the first set of key derivation data in the data migration request and the master key;

wherein the data migration request received from the second network communication device includes

the temporary key encoded with a public key of an asymmetric key pair, and

an authentication data value generated by the first network communication device using the first key, the second set of key derivation data, and the encoded temporary key; and

wherein the providing of the second key to the second network communication device is performed in response to verifying the authentication data value in the authentication data value using the derived first key.

5. The method of claim 1 , further comprising in response to authenticating the first network communication device, providing a protected set of data stored by the computing server to the first network communication device via a secure communication channel.

6. The method of claim 1 , further comprising in response to authenticating the first network communication device, performing a key-restricted set of operations for the first network communication device.

7. A method, comprising:

using a communication circuit of a first network communication device connected in a data network,

providing a first set of key derivation data to a second network communication device connected to the communication circuit via the data network, the second network communication device being configured to communicate with a computing server connected in the data network using a first key for authentication, the first key being derived from a master key stored at the computing server and from a second set of key derivation data stored at the second network communication device,

receiving, from the second network communication device, authorization data derived from the first key and from the first set of key derivation data using a one way function, and

receiving the second set of key derivation data from the second network communication device;

using a processing circuit of the first network communication device,

determining a temporary key, and

generating a data migration request including verification data from which the temporary key can be determined using the master key and authorization by the second network communication device can be verified, the verification data including the first and second sets of key derivation data; and

using the communication circuit of first network communication device,

providing the data migration request to the computing server,

receiving a second key from the computing server via a secure communication channel established using the temporary key; and

communicating with the computing server using the second key for authentication.

8. The method of claim 7 , wherein the temporary key is specified by the authorization data received from the second network communication device.

9. The method of claim 7 , further comprising:

receiving a public key of the computing server from the second network communication device;

encoding the temporary key using the public key;

providing the encoded temporary key to the second network communication device; and

wherein the authorization data received from the second network communication device is derived from the first key, the first set of key derivation data, and the encoded temporary key using the one way function.

10. The method of claim 9 , wherein the verification data in the data migration request includes the encoded temporary key and the authorization data.

11. An apparatus, comprising a computing server including:

a data storage circuit storing a master key;

a communication circuit configured and arranged to communicate data with a plurality of network communication devices connected in a data network;

a processing circuit connected to the communication circuit and configured and arranged to:

authenticate a first network communication device, via the communication circuit, using a first key, wherein the first key is derived from the master key and a first set of key derivation data stored on the first network communication device;

in response to receiving a data migration request from a second network communication device in the data network, via the communication circuit, determine a temporary key used by the second network communication device based on the first set of key derivation data and a second set of key derivation data specified in the data migration request and the master key;

generate a second key based on the master key and the second set of key derivation data;

provide the second key to the second network communication device, via the communication circuit, using a secure communication channel established using the temporary key; and

authenticate the second network communication device, via the communication circuit using the second key.

12. The apparatus of claim 11 , wherein the processing circuit is further configured and arranged to:

receive the first set of key derivation data, via the communication circuit, from the first network communication device connected in the data network;

generate the first key for the first network communication device based on the master key stored in the data storage circuit and the first set of key derivation data received from the first network communication device; and

provide the first key to the first network communication device via the communication circuit.

13. The apparatus of claim 11 , wherein the processing circuit is further configured and arranged to provide the first network communication device access to a protected set of data stored in the data storage circuit via the communication circuit using a secure communication channel established using the first key.

14. The apparatus of claim 11 , wherein the processing circuit includes

a key generation circuit configured and arranged to implement a key derivation function;

an encryption/decryption circuit; and

an access control circuit configured and arranged to restrict access to a protected set of data to authenticated with the first and second keys.

15. The apparatus of claim 11 , wherein

the data migration request includes the temporary key encrypted with a public key of an asymmetric key pair stored in the data storage circuit; and

the processing circuit is configured and arranged to

decrypt the encrypted temporary key using a private key of the asymmetric key pair and compare the decrypted result to the determined temporary key; and

provide the generated second key to the second network communication device in response to the decrypted result matching the determined temporary key.

16. The apparatus of claim 11 , wherein the processing circuit is configured and arranged to prevent the generated second key from being provided to the second network communication device in response to a set of criteria being satisfied.

17. The apparatus of claim 11 , wherein the processing circuit is configured and arranged to, in response to network traffic indicating that the first network communication device may be compromised,

prevent the generated second key from being provided to the second network communication device until authorization for transfer of the second key is verified by a user via an email, text message, automated call, or a combination thereof.

18. The apparatus of claim 11 , wherein

the first key is included in a set of keys for a user account; and

the processing circuit is configured and arranged to prevent the generated second key from being provided to the second network communication device in response to a number of keys in the set of keys for the user account exceeding a threshold.

19. The apparatus of claim 11 , further comprising:

the first network communication device, wherein the first network communication device includes

a first circuit configured and arranged to communicate data via the data network; and

a second circuit connected to the first circuit and configured and arranged to, in response to receiving the second set of key derivation data via the first circuit, generate the temporary key based on the first key and the second set of key derivation data and provide the temporary key to the second network communication device via the first circuit; and

the second network communication device, wherein the second network communication device includes

a third circuit configured and arranged to communicate data via the data network; and

a fourth circuit connected to the third circuit and configured and

arranged to

provide the second set of key derivation data to the first network communication device via the third circuit, and

in response to receiving the temporary key, generate the data migration request and provide the data migration request to the computing server via the third circuit.

20. The apparatus of claim 11 , further comprising:

the first network communication device, wherein the first network communication device includes

a first circuit configured and arranged to communicate data via the data network; and

a second circuit connected to the first circuit and configured and arranged to, in response to receiving an encrypted temporary key from the second network communication device via the third circuit, derive authentication data from the encrypted temporary key and the first key and provide the authentication data to the second network communication device; and

the second network communication device, wherein the second network communication device includes

a third circuit configured and arranged to communicate data via the data network; and

a fourth circuit connected to the third circuit and configured and

arranged to

in response to receiving a public key of the computing server from the first network communication device via the third circuit, generate the temporary key, encrypt the temporary key with the public key to produce the encrypted temporary key, and provide the encrypted temporary key to the first network communication device via the data network; and

generate the data migration request in response to receiving the authentication data, the data migration request including the first and second sets of key derivation data, the encrypted temporary key, and the authentication data.