Secure object access

1. A method of a security system to provide access by a requester to an encrypted data object stored in an object store, the requester being authenticated by the object store using at least a first factor of authentication, the method comprising:

receiving, from the object store, the encrypted data object having associated an object identifier, and an identifier of the requester;

deriving a first cryptographic key to decrypt the encrypted data object into a decrypted object;

deriving a second cryptographic key;

re-encrypting the decrypted object based on the second cryptographic key into a re-encrypted object and communicating the re-encrypted object to the requester;

wherein each of the first cryptographic key and the second cryptographic key are symmetric cryptographic keys that are based on the object identifier, the requester identifier, and a secret key portion generated by the security system, the secret key portion being different for each of the first cryptographic key and the second cryptographic key, the method further comprising:

in response to a second authentication of the requester by the security system using at least a second factor of authentication different from the first factor of authentication, communicating the secret key portion for the second cryptographic key to the requester; and

wherein the authentication by the object store and the second authentication are undertaken using different authentication techniques.

2. The method of claim 1 wherein the encrypted data object results from an encryption of a data object by the security system using the first cryptographic key, the encrypted data object being stored in the object store.

3. The method of claim 2 wherein access to the secret key portion for the first cryptographic key is restricted to the security system.

4. A security system to provide access by a requester to an encrypted data object stored in an object store, the requester being authenticated by the object store using at least a first factor of authentication, the system comprising:

a central processor unit;

a first interface to communicate with the object store to receive the encrypted data object having associated an object identifier, and an identifier of the requester;

a key derivation system to generate, using the central processor unit, a first cryptographic key and a second cryptographic key, the first cryptographic key being used by a decrypter to decrypt the encrypted data object into a decrypted object;

wherein the first cryptographic key and the second cryptographic key are symmetric cryptographic keys;

an encrypter to re-encrypt the decrypted object into a re-encrypted object based on the second cryptographic key;

a second interface to communicate with the requester;

wherein each of the first cryptographic key and the second cryptographic key are based on the object identifier, the requester identifier, and a secret key portion generated by the security system, the secret key portion being different for each of the first cryptographic key and the second cryptographic key;

wherein the re-encrypted object is provided to the object store via the first interface for access by the requester;

wherein the system further comprises:

an access control system including a challenge generator to further authenticate the requester based on a response to a challenge received via the second interface, the response to the challenge being different from the first factor of authentication;

wherein the authentication by the object store and the access control system are undertaken using different authentication techniques; and

wherein the second interface is further responsive to the access control system to communicate the secret key portion for the second cryptographic key to the requester.

5. The system of claim 4 wherein the encrypted data object results from an encryption of a data object by the security system using the first cryptographic key, the encrypted data object being stored in the object store.

6. The system of claim 4 wherein access to the secret key portion for the first cryptographic key is restricted to the security system.

7. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code which, when loaded into a computer system and executed thereon, causes the computer system to perform a method comprising:

providing access by a requester to an encrypted data object stored in an object store, the requester being authenticated by the object store using at least a first factor of authentication by:

receiving, from the object store, by a security system, the encrypted data object having associated an object identifier, and an identifier of the requester,

deriving a first cryptographic key to decrypt the encrypted data object into a decrypted object,

deriving a second cryptographic key, each of the first cryptographic key and the second cryptographic key being based on the object identifier, the requester identifier, and a secret key portion generated by the security system, the secret key portion being different for each of the first cryptographic key and the second cryptographic key,

wherein the first cryptographic key and the second cryptographic key are symmetric cryptographic keys;

re-encrypting the decrypted object based on the second cryptographic key into a re-encrypted object and communicating the re-encrypted object to the requester, and

in response to a second authentication of the requester by the security system using at least a second factor of authentication different from the first factor of authentication, communicating the secret key portion for the second cryptographic key to the requester;

wherein the authentication by the object store and the second authentication are undertaken using different authentication techniques.