Method and system for initializing a key management system

1. A method for securing encryption keys in a key management system (KMS) comprising:

receiving data into the KMS, wherein the data comprises a key, a key name, and a key type, and wherein the data is received from a client over a network;

receiving at least one key encryption key (KEK) into the KMS, wherein the KEK is received from the client using a smart card interfacing over the network with the KMS, wherein the smart card stores the KEK;

encrypting the key, the key name, and the key type using the KEK to generate a secret token, wherein the encryption is performed by the KMS;

hashing the KEK to generate a hashed KEK;

generating a vector comprising the secret token and the hashed KEK, wherein the secret token comprises the encrypted key;

serializing the vector to generate a serialized file; and

storing the serialized file in KMS memory.

2. The method of claim 1 , further comprising:

storing the key, the key name, and the key type in a 3-tuple prior to encrypting the key, the key name, and the key type.

3. The method of claim 2 , further comprising:

encoding the key after storing the key in the 3-tuple.

4. The method of claim 1 , further comprising:

tagging the secret token to associate it with an application.

5. The method of claim 1 , wherein encrypting the key, the key name, and the key type comprises:

using a symmetric algorithm.

6. The method of claim 1 , wherein encrypting the key, the key name, and the key type comprises:

using an asymmetric algorithm.

7. The method of claim 1 , wherein receiving data into the KMS comprises:

using a graphical user interface.

8. The method of claim 7 , wherein the graphical user interface is integrated into a web browser.

9. The method of claim 1 , wherein the serialized file persists beyond the time the KMS is active and provides secure storage of the key and the KEK.

10. A system for securing encryption keys comprising:

a key management system storage; and

a key management system (KMS) configured to:

receive data into the KMS, wherein the data comprises a key, a key name, and a key type, and wherein the data is received from a client over a network;

receive at least one key encryption key (KEK) into the KMS, wherein the KEK is received from the client using a smart card interfacing over the network with the KMS, wherein the smart card provides the KEK;

encrypt the key, the key name, and the key type using the KEK to generate a secret token, wherein the encryption is performed by the KMS;

hash the KEK to generate a hashed KEK;

generate a vector comprising the secret token and the hashed KEK, wherein the secret token comprises the encrypted key;

serialize the vector to generate a serialized file; and

store the serialized file in KMS memory.

11. The system of claim 10 , wherein the KMS is further configured to store the key, the key name, and the key type in an 3-tuple prior to encrypting the key, the key name, and the key type.

12. The system of claim 11 , wherein the KMS is further configure to:

encode the key after storing the key in the 3-tuple.

13. The system of claim 10 , wherein the KMS is further configured to:

tag the secret token to associate it with an application.

14. The system of claim 10 , further comprising:

a graphical user interface.

15. The system of claim 14 , wherein the graphical user interface is integrated into a web browser.

16. The system of claim 10 , wherein the serialized file persists beyond the time the KMS is active and provides secure storage of the key and the KEK.

17. A computer readable medium storing instructions for execution on a key management system (KMS) processor, which when executed by the KMS processor cause the KMS processor to perform the steps of:

receiving data into the KMS, wherein the data comprises a key, a key name, and a key type, and wherein the data is received from a client over a network;

receiving at least one key encryption key (KEK) into the KMS, wherein the KEK is received from the client using a smart card interfacing over the network with the KMS, wherein the smart card stores the KEK;

encrypting the key, the key name, and the key type using the KEK to generate a secret token, wherein the encryption is performed by the KMS;

hashing the KEK to generate a hashed KEK;

generating a vector comprising the secret token and the hashed KEK, wherein the secret token comprises the encrypted key;

serializing the vector to generate a serialized file; and

storing the serialized file in KMS memory.

18. The computer readable medium of claim 17 , wherein the instructions further comprise instructions for:

storing the key, the key name, and the key type in a 3-tuple prior to encrypting the key, the key name, and the key type.

19. The computer readable medium of claim 18 , wherein the instructions further comprise instructions for encoding the key after storing the key in the 3-tuple.

20. The computer readable medium of claim 17 , wherein the instructions further comprise instructions for tagging the secret token to associate it with an application.

21. The computer readable medium of claim 17 , wherein the instructions further comprise instructions for using a symmetric algorithm.

22. The computer readable medium of claim 17 , wherein the instructions further comprise instructions for encrypting the key, the key name, and the key type using an asymmetric algorithm.

23. The computer readable medium of claim 17 , wherein the serialized file persists beyond the time the KMS is active and provides secure storage of the key and the KEK.