A method for protecting the transfer and storage of data by
encryption using a private key encrypted with a first key encrypting key, which is encrypted using a second key encrypting key. This latter key is encrypted using a hashed
passphrase value, obtained by hashing a
passphrase known only to the authorized user. Upon
receipt of a request initiated by the user by entering a
passphrase, a first hashed passphrase is transferred to a first
data processing system, where it is compared with a predefined hash string. If they match, the first
data processing system transfers to a second
data processing system the encrypted second key encrypting key. A
candidate key is obtained by decrypting the encrypted second key encrypting key using a second hashed passphrase. Upon successful validation of the
candidate key, the passphrase is verified and the user is authenticated. After the user has been authenticated, the first
data processing system transmits to the second
data processing system the encrypted private key and the encrypted data. The second
processing system then decrypts the encrypted first key encrypting key using the second key encrypting key, decrypts the encrypted private key using the first key encrypting key and finally decrypts the data using the private key.