Derived unique key per raindrop (DUKPR)

A method for managing encryption for data stored by a cloud provider server, the method comprising:

• sending, by the cloud provider server to a key management server, a request for a drop key, the drop key corresponding to a cipher drop, wherein a raindrop comprises at least the cipher drop, the cipher drop is a unit of data stored by the cloud provider server, and the request includes at least a hash drop and a drop identifier, the hash drop is a hash of cleartext data associated with the cipher drop and the drop identifier that uniquely identifies the cipher drop;
• receiving, by the cloud provider server from the key management server, the drop key, wherein the drop key is derived based on the hash drop the drop identifier;
• and
• decrypting the cipher drop with the drop key.

A cloud provider server, comprising:

• a processing circuit configured to:
• send to a key management server a request for a drop key, the drop key corresponding to a cipher drop, wherein a raindrop comprises at least the cipher drop, the cipher drop is a unit of data stored by the cloud provider server, and the request includes at least a hash drop and a drop identifier, the hash drop is a hash of cleartext data associated with the cipher drop, and the drop identifier uniquely identifies the cipher drop;
• receive from the key management server the drop key, wherein the drop key is derived based on the hash drop and the drop identifier;
• and
• decrypt the cipher drop with the drop key.

A non-transitory computer-readable medium of a cloud provider server storing computer-readable instructions such that, when executed, causes a processor to:

• send to a key management server a request for a drop key, the drop key corresponding to a cipher drop, wherein a raindrop comprises at least the cipher drop, the cipher drop is a unit of data stored by the cloud provider server, and the request includes at least a hash drop and a drop identifier, the hash drop is a hash of cleartext data associated with the cipher drop and the drop identifier uniquely identifies the raindrop;
• receive from the key management server the drop key, wherein the drop key is derived based on the hash drop and the drop identifier;
• and
• decrypt the cipher drop with the drop key.