Enforcing multi-ownership of data on storage
A computer-implemented method for providing a secure data access service that encrypts data is disclosed. The method includes: wrapping a data encryption key by at least two customer root keys, wherein the at least two customer root keys are assigned to different user identifiers, and wherein the at least two customer root keys are stored in different hardware security modules, and wherein a wrapping structure for the at least two customer root keys is applied according to an access policy that defines which of the assigned user identifiers must concur to enable a data access to the encrypted data by the secure data access service; and encrypting the data by the secure data access service using the unwrapped data encryption key.
1. A computer-implemented method for providing a secure data access service that encrypts data, said computer-implemented method comprising:
wrapping a data encryption key, which is only valid for a limited time window, by at least two customer root keys to obtain a wrapped data encryption key, wherein said at least two customer root keys are assigned to different user identifiers, said at least two customer root keys are stored in different hardware security modules which are linked to individual user identifiers of respective operators, and wherein wrapping the data encryption key further comprises a wrapping structure codified within the secure data access service for said at least two customer root keys is applied in an ascending or descending order of the at least two customer root keys according to an access policy that defines which of said assigned user identifiers must concur to enable a data access to said encrypted data by said secure data access service, wherein the data encryption key is passed from the secure data access service to another data access function for a final data access;
and encrypting data by said secure data access service using an unwrapped data encryption key, wherein prior to encrypting the data using the unwrapped data encryption key, the secure data access service requests an unwrapped operation on the wrapped data encryption key and wherein the unwrapped operation on the wrapped data encryption key is performed using the at least two customer root keys in ascending or descending order of the at least two customer root keys according to the access policy.
2. The computer-implemented method according to claim 1 , wherein said wrapping structure defines a sequence of application of said at least two customer root keys for said wrapping of said data encryption key.
3. The computer-implemented method according to claim 1 , wherein said secure data access service stores only said wrapped data encryption key.
4. The computer-implemented method according to claim 1 , wherein said different hardware security modules are virtual different hardware security modules.
5. The computer-implemented method according to claim 1 , wherein said at least two customer root keys are n customer root keys out of m customer root keys, wherein m>n.
6. The computer-implemented method according to claim 1 , wherein said at least two customer root keys are symmetric encryption/decryption keys.
7. The computer-implemented method according to claim 1 , wherein said at least two customer root keys have to be different.
8. The computer-implemented method according to claim 1 , wherein said data encryption key is a symmetrical or asymmetric key.
9. The computer-implemented method according to claim 1 , wherein said wrapping structure defines a sequence of application of said at least two customer root keys for an unwrapping of said data encryption key.
10. A data protection system for providing a secure data access service that encrypts data, said data protection system comprising:
a processor and a memory, communicatively coupled to said processor, wherein said memory stores program code portions that, when executed, enable said processor, to:
wrap a data encryption key, which is only valid for a limited time window, by at least two customer root keys to obtain a wrapped data encryption key, wherein said at least two customer root keys are assigned to different user identifiers, said at least two customer root keys are stored in different hardware security modules which are linked to individual user identifiers of respective operators, and wherein wrapping the data encryption key further comprises a wrapping structure codified within the secure data access service for said at least two customer root keys is applied in an ascending or descending order of the at least two customer root keys according to an access policy that defines which of said assigned user identifiers must concur to enable a data access to said encrypted data by said secure data access service, wherein the data encryption key is passed from the secure data access service to another data access function for a final data access;
and encrypt data by said secure data access service using an unwrapped data encryption key, wherein prior to encrypting the data using the unwrapped data encryption key, the secure data access service requests an unwrapped operation on the wrapped data encryption key and wherein the unwrapped operation on the wrapped data encryption key is performed using the at least two customer root keys in ascending or descending order of the at least two customer root keys according to the access policy.
11. The data protection system according to claim 10 , wherein said wrapping structure defines a sequence of application of said at least two customer root keys for said wrapping of said data encryption key.
12. The data protection system according to claim 10 , wherein said secure data access service stores only said wrapped data encryption key.
13. The data protection system according to claim 10 , wherein said different hardware security modules are physical different hardware security modules, virtual different hardware security modules or a mixture thereof.
14. The data protection system according to claim 10 , wherein said at least two customer root keys are n customer root keys out of m customer root keys, wherein m>n.
15. The data protection system according to claim 10 , wherein said at least two customer root keys are symmetric encryption/decryption keys.
16. The data protection system according to claim 10 , wherein said at least two customer root keys have to be different.
17. A computer program product for data protection system, said computer program product comprising:
a computer readable storage medium having program instructions embodied therewith, said program instructions being executable by one or more computing systems or controllers to cause said one or more computing systems to:
wrap a data encryption key, which is only valid for a limited time window, by at least two customer root keys to obtain a wrapped data encryption key, wherein said at least two customer root keys are assigned to different user identifiers which are linked to individual user identifiers of respective operators, said at least two customer root keys are stored in different hardware security modules, and wherein wrapping the data encryption key further comprises a wrapping structure codified within the secure data access service for said at least two customer root keys is applied in an ascending or descending order of the at least two customer root keys according to an access policy that defines which of said assigned user identifiers must concur to enable a data access to said encrypted data by said secure data access service, wherein the data encryption key is passed from the secure data access service to another data access function for a final data access;
and encrypt data by said secure data access service using an unwrapped data encryption key, wherein prior to encrypting the data using the unwrapped data encryption key, the secure data access service requests an unwrapped operation on the wrapped data encryption key and wherein the unwrapped operation on the wrapped data encryption key is performed using the at least two customer root keys in ascending or descending order of the at least two customer root keys according to the access policy.