Providing a secure object store using a hierarchical key system

A computing system comprising:

• a secure object store comprised of a plurality of data objects residing on a plurality of nodes;
• and
• a hardware processor to execute instructions to implement a hierarchical key structure, wherein the hierarchical key structure includes:
• a Node Key Encryption Key, wherein the Node Key Encryption Key is associated with a given node of a plurality of nodes;
• and
• a plurality of Data Encryption Keys, each Data Encryption Key corresponding to a respective data object of the plurality of data objects,
• wherein the hardware processor to execute the instructions to:
• generate the plurality of Data Encryption Keys using the Node Key Encryption Key;
• encrypt the plurality of data objects using the Data Encryption Keys to provide a plurality of encrypted data objects to be stored on the given node, wherein each data object of the plurality of data objects is encrypted by a respective Data Encryption Key, is associated with a different user of a plurality of users, and contains data representing a level of access of the associated user;
• and
• access an encrypted data object of the plurality of encrypted data objects using the Node Key Encryption Key and a selected Data Encryption Key of the Data Encryption Keys.

A method for use in a computing system, comprising:

• hosting a secure object store including a plurality of data objects on a plurality of nodes of a computing system;
• securing the secure object store using a hierarchical key system including:
• encrypting a given Node Key Encryption Key of a plurality of Node Key Encryption Keys, wherein the given Node Key Encryption Key is associated with a given node of the plurality of nodes;
• and
• encrypting a plurality of Data Encryption Keys from the given Node Key Encryption Key, wherein each Data Encryption Key of the plurality of Data Encryption Keys corresponds to a respective data object of the plurality of data objects, each data object of the plurality of data objects is encrypted by a respective Data Encryption Key of the plurality of Data Encryption Keys to provide a corresponding encrypted data object of a plurality of encrypted data objects, each data object of the plurality of data objects is associated with a different user of a plurality of users, and each data object of the plurality of data objects contains data representing a level of access of the associated user.