MULTI-LAYERED ENCRYPTION

摘要

Techniques are described herein for encrypting data using a multi-layered encryption process. A service may encrypt data with first and second data keys and store the encrypted data. The system may encrypt the first data key with a first user key and the second data key with a second user key and store the data keys and the user keys in separate locations. The service may associate the user keys with a client device. In one aspect, the user keys may each include and be stored as a set of system keys and a set of ordered pairs of numeric values, with each ordered pair containing a start value and a read length value associated with one of the set of system keys. The service may assemble each user key by combining data from each of the system keys according to the associated ordered pair.

主权项

1. A method of controlling access to data via multiple encryption keys by a data service, the method comprising:
encrypting user data with a first data key and a second data key and storing the encrypted user data in a data database; encrypting the first data key with a first user key; encrypting the second data key with a second user key;storing the first data key and the second data key and the first user key and the second user key in separate locations; andassociating the first user key and the second user key with a client device.