FIELD

This invention relates to encryption and more particularly relates to the secure handling and storage of credentials and/or other user information.

BACKGROUND

Users' sensitive data is constantly under attack by hackers attempting to misappropriate the users' data. Therefore, it is important to secure data at all points within a system where the data may be misappropriated, e.g., while the data is at rest, while the data is being transmitted, or the like. Similarly, it is important to secure keys that are used to encrypt data so that the keys are also not misappropriated to decrypt the data.

BRIEF SUMMARY

An apparatus, in one embodiment, includes a lock module that receives a request to decrypt encrypted data that is stored in a data repository, the encrypted data encrypted using a first encryption key, and unlocks an encryption engine in response to the request. An encryption engine may be unlocked using a master key that is generated based on combination of a plurality of keys held by a plurality of key holders. An apparatus, in a further embodiment, includes a decryption module that decrypts encrypted data using an encryption engine. Encrypted data may be decrypted using a first encryption key. An apparatus, in certain embodiments, includes an encryption module that re-encrypts decrypted data using an encryption engine. Decrypted data may be re-encrypted with a second encryption key that is different than a first encryption key and stored in a data repository.

A system, in one embodiment, includes a data repository that stores encrypted data, an encryption engine, and an apparatus. An apparatus, in one embodiment, includes a lock module that receives a request to decrypt encrypted data that is stored in a data repository, the encrypted data encrypted using a first encryption key, and unlocks an encryption engine in response to the request. An encryption engine may be unlocked using a master key that is generated based on combination of a plurality of keys held by a plurality of key holders. An apparatus, in a further embodiment, includes a decryption module that decrypts encrypted data using an encryption engine. Encrypted data may be decrypted using a first encryption key. An apparatus, in certain embodiments, includes an encryption module that re-encrypts decrypted data using an encryption engine. Decrypted data may be re-encrypted with a second encryption key that is different than a first encryption key and stored in a data repository.

An apparatus, in one embodiment, includes means for receiving a request to decrypt encrypted data that is stored in a data repository, the encrypted data encrypted using a first encryption key, and means for unlocking an encryption engine in response to the request. An encryption engine may be unlocked using a master key that is generated based on combination of a plurality of keys held by a plurality of key holders. An apparatus, in a further embodiment, includes means for decrypting encrypted data using an encryption engine. Encrypted data may be decrypted using a first encryption key. An apparatus, in certain embodiments, includes means for re-encrypting decrypted data using an encryption engine. Decrypted data may be re-encrypted with a second encryption key that is different than a first encryption key and stored in a data repository.

