Preventing encryption key recovery by a cloud provider

An apparatus for encryption key storage at an application server, comprising:

• a processor;
• memory in electronic communication with the processor;
• and
• instructions stored in the memory and executable by the processor to cause the apparatus to:
• identify, at the application server, an encryption process to perform on a first data object;
• receive, at the application server, from a user associated with a user device, data encryption key data corresponding to the encryption process;
• derive, at the application server, a data encryption key based on the data encryption key data and a second fragment of the data encryption key retrieved from a database;
• store the data encryption key data and the data encryption key in volatile memory of the application server;
• perform, at the application server, the encryption process on the first data object by accessing the data encryption key from the volatile memory;
• restart, at the application server and in response to receiving a key destruction request from the user, the application server, wherein the restarting the application server removes the data encryption key data and the data encryption key from the volatile memory;
• and
• receive, at the application server, from the user, the data encryption key data after the restarting the application server, wherein after the restarting the application server, the application server lacks an ability to derive the data encryption key until receiving the data encryption key data from the user.

A non-transitory computer-readable medium storing code for encryption key storage at an application server, the code comprising instructions executable by a processor to:

• identify, at the application server, an encryption process to perform on a first data object;
• receive, at the application server, from a user associated with a user device, data encryption key data corresponding to the encryption process;
• derive, at the application server, a data encryption key based on the data encryption key data and a second fragment of the data encryption key retrieved from a database;
• store the data encryption key data and the data encryption key in volatile memory of the application server;
• perform, at the application server, the encryption process on the first data object by accessing the data encryption key from the volatile memory;
• restart, at the application server and in response to receiving a key destruction request from the user, the application server, wherein the restarting the application server removes the data encryption key data and the data encryption key from the volatile memory;
• and
• receive, at the application server, from the user, the data encryption key data after the restarting the application server, wherein after the restarting the application server, the application server lacks an ability to derive the data encryption key until receiving the data encryption key data from the user.