Authenticated copying of encryption keys between secure zones

Abstract

The solutions disclosed enable security credentials to be shared between two entities. Embodiments of the present invention can be used to facilitate the transfer security credentials associated with a first level of permission of a first entity to a second entity that does not have the security credentials associated with the first level of permission in response to receiving a request to share security credentials between two entities.

What is claimed: 
     
         1 . A method for controlling access security credentials specifying different levels of permission, comprising:
 responsive to receiving a request to share security credentials between two entities, facilitating, by one or more processors, an enrollment of respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission, wherein facilitating, by one or more processors, an enrollment of respective security credentials associated with the two entities, wherein each security credential specifies a different level of permission comprises:
 receiving, by one or more processors, a token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with the first level of permission from the first zone, 
 decrypting, by one or more processors, data associated with the first level of permission, 
 encrypting, by one or more processors, the data associated with the first level of permission using the received key-encrypting-key, 
 writing, by one or more processors, the encrypted data to a temporary file, and 
 establishing, by one or more processors, a secure connection between the first entity having security credentials associated with first level of permission and the second entity that does not have the security credentials associated with the first level of permission; 
   retrieving, by one or more processors, the encrypted data from the temporary file and the token associated with a key-encrypting-key associated with the first level of permission,   transferring, by one or more processors, security credentials associated with a first level of permission of a first entity to a second entity that does not have the security credentials associated with the first level of permission using a token, wherein the token identifies a key-encrypting-key used to encrypt the data associated with the first level of permission from the first entity;   responsive to decrypting the encrypted data, enabling, by one or more processors, temporary access to the security credentials associated with the first level of permission;   maintaining, by one or more processors, the first level of permission associated with the first entity while transferring the security credentials from the first entity to the second entity; and   responsive to maintaining the first level of permission associated with the first entity while transferring the security credentials from the first entity to the second entity, establishing, by one or more processors, a secure connection between the first entity having security credentials associated with first level of permission and the second entity that does not have the security credentials associated with the first level of permission.