Cloud key escrow system

1. A computer implemented method for securely storing encrypted data and providing access to the stored encrypted data according to a predefined policy, the method comprising:

receiving a request to access stored, encrypted data, the encrypted data being stored in a data storage system according to a predefined policy, the encryption preventing the storage system from accessing unencrypted data decrypted from the encrypted data, the policy allowing the encrypted data to be provided to an authorized entity only upon receiving a threshold number of requests from verified third parties;

in response to receiving the request to access the stored, encrypted data, sending a query to a plurality of the verified third parties, the query requesting permission from the verified third parties to access the stored, encrypted data according to the predefined policy;

receiving a response to the query from at least a threshold number of the verified third parties, each received response including permission to access the stored, encrypted data; and

in response to receiving permission to access the stored, encrypted data from at least a threshold number of the verified third parties, allowing the requesting party to access the user's stored, encrypted data according to the predefined policy.

2. The method of claim 1 , wherein a stored encrypted key is stored as a plurality of shares, the shares being mathematical transformations of a user's private key, and wherein each share is provided to one of the verified third parties.

3. The method of claim 2 , wherein each verified third party publishes their own public keys and encrypts their share of the encrypted key using their published public key.

4. The method of claim 1 , wherein the request to access the stored, encrypted data comprises a request for each verified third party to provide an assigned share to the storage system.

5. The method of claim 1 , wherein verified third party shares encrypted according to the third party's public keys are stored in the data storage system, the encrypted shares preventing the data storage system from accessing the stored encrypted data.

6. The method of claim 1 , wherein a verifiable secret sharing scheme performs a verification without opening or looking at the encrypted data.

7. The method of claim 1 , wherein the predefined policy indicates a set of rules comprising logic indicating which specific verified third parties are to request release of the encrypted data before the data storage system will release the encrypted data.

8. A computer program product for implementing a method for securely storing encrypted data and providing access to the stored encrypted data according to a predefined policy, the computer program product comprising one or more computer readable storage devices having encoded therein computer executable instructions which, when executed upon one or more computer processors, cause the processors to perform the method comprising:

receiving a request to access stored, encrypted data, the encrypted data being stored in a data storage system according to a predefined policy, the encryption preventing the storage system from accessing unencrypted data decrypted from the encrypted data, the policy allowing the encrypted data to be provided to an authorized entity only upon receiving a threshold number of requests from verified third parties;

in response to receiving the request to access the stored, encrypted data, sending a query to a plurality of the verified third parties, requesting permission from the verified third parties to access the stored, encrypted data according to the predefined policy;

receiving a response to the query from at least a threshold number of the verified third parties, each received response including permission to access the stored, encrypted data; and

in response to receiving permission to access the stored, encrypted data from at least a threshold number of the verified third parties, allowing the requesting party to access the user's stored, encrypted data according to the predefined policy.

9. The computer program product of claim 8 , wherein a stored encrypted key is stored as a plurality of shares, the shares being mathematical transformations of a user's private key, and wherein each share is provided to one of the verified third parties.

10. The computer program product of claim 9 , wherein each verified third party publishes their own public keys and encrypts their share of the encrypted key using their published public key.

11. The computer program product of claim 8 , wherein the request to access the stored, encrypted data comprises a request for each verified third party to provide an assigned share to the storage system.

12. The computer program product of claim 8 , wherein verified third party shares encrypted according to the third party's public keys are stored in the data storage system, the encrypted shares preventing the data storage system from accessing the stored encrypted data.

13. The computer program product of claim 8 , wherein a verifiable secret sharing scheme performs a verification without opening or looking at the encrypted data.

14. The computer program product of claim 8 , wherein the predefined policy indicates a set of rules comprising logic indicating which specific verified third parties are to request release of the encrypted data before the data storage system will release the encrypted data.

15. A computer system for implementing a method for securely storing encrypted data and providing access to the stored encrypted data according to a predefined policy, the system comprising one or more computer processors and computer readable media having encoded therein computer executable instructions which, when executed upon the one or more processors, cause the system to perform the method comprising:

receiving a request to access stored, encrypted data, the encrypted data being stored in a data storage system according to a predefined policy, the encryption preventing the storage system from accessing unencrypted data decrypted from the encrypted data, the policy allowing the encrypted data to be provided to an authorized entity only upon receiving a threshold number of requests from verified third parties;

in response to receiving the request to access the stored, encrypted data, sending a query to a plurality of the verified third parties, requesting permission from the verified third parties to access the stored, encrypted data according to the predefined policy;

receiving a response to the query from at least a threshold number of the verified third parties, each received response including permission to access the stored, encrypted data; and

in response to receiving permission to access the stored, encrypted data from at least a threshold number of the verified third parties, allowing the requesting party to access the user's stored, encrypted data according to the predefined policy.

16. The system of claim 15 , wherein a stored encrypted key is stored as a plurality of shares, the shares being mathematical transformations of a user's private key, and wherein each share is provided to one of the verified third parties.

17. The system of claim 16 , wherein each verified third party publishes their own public keys and encrypts their share of the encrypted key using their published public key.

18. The system of claim 15 , wherein the request to access the stored, encrypted data comprises a request for each verified third party to provide an assigned share to the storage system.

19. The system of claim 15 , wherein verified third party shares encrypted according to the third party's public keys are stored in the data storage system, the encrypted shares preventing the data storage system from accessing the stored encrypted data.

20. The system of claim 15 , wherein a verifiable secret sharing scheme performs a verification without opening or looking at the encrypted data.