Data operations using a proxy encryption key

A method for operating upon encrypted data within a particular data scope for which there is a base encryption key established and stored in a base encryption key store that stores base encryption keys for a plurality of data scopes so as not to thereafter reveal the base encryption key to the computing system, the method comprising:

• causing a base encryption key to be established, associated with the particular data scope, and stored in a base encryption key store
• establishing a proxy encryption key that is also associated with the particular data scope;
• causing the proxy encryption key to be encrypted using the base encryption key;
• storing the encrypted proxy encryption key in a proxy encryption key store;
• performing a plurality of operations using the encrypted proxy encryption key,
• a first operation of the plurality of operations involving accessing the encrypted proxy encryption key from the proxy encryption key store, acquire a decrypted form of the proxy encryption key that was decrypted using the base encryption key, and storing the decrypted form of the proxy encryption key in protected cache,
• the remainder of the plurality of operations using the cached decrypted form of the proxy encryption key to perform the respective remainder of the plurality of operations;
• and
• after the plurality of operations are performed, removing the decrypted form of the proxy encryption key from the protected cache.

A computer program product comprising one or more computer-readable hardware storage device having computer-executable instructions that are structured such that, when executed by one or more processors of a computing system, the computing system is caused to perform a method for operating upon encrypted data within a particular data scope for which there is a base encryption key established and stored in a base encryption key store that stores base encryption keys for a plurality of data scopes so as not to thereafter reveal the base encryption key to the computing system, the method comprising:

• causing a base encryption key to be established, associated with the particular data scope, and stored in a base encryption key store
• establishing a proxy encryption key that is also associated with the particular data scope;
• causing the proxy encryption key to be encrypted using the base encryption key;
• storing the encrypted proxy encryption key in a proxy encryption key store;
• performing a plurality of operations using the encrypted proxy encryption key,
• a first operation of the plurality of operations involving accessing the encrypted proxy encryption key from the proxy encryption key store, acquire a decrypted form of the proxy encryption key that was decrypted using the base encryption key, and storing the decrypted form of the proxy encryption key in protected cache,
• the remainder of the plurality of operations using the cached decrypted form of the proxy encryption key to perform the respective remainder of the plurality of operations;
• and
• after the plurality of operations are performed, removing the decrypted form of the proxy encryption key from the cache.