# US 11,113,408 B2 · Providing a secure object store using a hierarchical key system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,408 B2 - Document ID: US11113408B2 - Status: Granted - Kind: B2 - Application number: 16/105,214 - Filed: 2018-08-20 - Published: 2020-02-20 - Granted: 2021-09-07 - Earliest claimed: 2018-08-20 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Gareth David Richards; Michael William Francis Healey, Jr. - Web page: https://patentgrep.com/patent/US11113408B2 ## CPC - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/0836: {using tree structure or hierarchical structure} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 9/0822: {using key encryption key} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for use in managing a secure object store in a computing system includes: securing the secure object store including creating, maintaining, and using a hierarchical key system and accessing an encrypted data object using the Node Key Encryption Key and a selected one of the Data Encryption Keys. The securing includes: generating a Node Key Encryption Key; generating a plurality of Data Encryption Keys that are encrypted using the Node Key Encryption Key; and encrypting a plurality of data objects using the Data Encryption Keys, each data object being encrypted by a respective Data Encryption Key. ## Claims ### Claim 1 A method including: securing a secure object store in a computing system, wherein securing the secure object store includes creating, maintaining, and using a hierarchical key system, and the securing including: generating a Node Key Encryption Key, wherein the Node Key Encryption Key is associated with a given node of a plurality of nodes; generating a plurality of Data Encryption Keys that are encrypted using the Node Key Encryption Key; and encrypting a plurality of data objects using the Data Encryption Keys to provide a plurality of encrypted data objects to be stored on the given node, wherein each data object of the plurality of data objects is encrypted by a respective Data Encryption Key, is associated with a different user of a plurality of users, and contains data representing a level of access of the associated user; and accessing an encrypted data object of the plurality of encrypted data objects using the Node Key Encryption Key and a selected Data Encryption Key of the Data Encryption Keys. ### Claim 2 (depends on 1) The method of claim 1, wherein the secure object store comprises an identity store. ### Claim 3 (depends on 1) The method of claim 1, wherein securing the secure object store further includes: generating a Storage Class Key Encryption Key; encrypting the Storage Class Key Encryption Key under the Node Key Encryption Key; and generating a plurality of Data Encryption Keys from the Storage Class Key Encryption Key. ### Claim 4 (depends on 3) The method of claim 3, wherein the Storage Class Key Encryption Key and the Data Encryption Keys are used to share data across the plurality of nodes within a cluster. ### Claim 5 (depends on 1) The method of claim 1, wherein accessing the encrypted data object includes unlocking the encrypted data object using the Node Key Encryption Key and the selected Data Encryption Key in one of multiple unlock protocols. ### Claim 6 (depends on 5) The method of claim 5, wherein the unlock protocols include a key splitting unlock protocol, a stable system values unlock protocol, and a trusted platform module unlock protocol. ### Claim 7 (depends on 1) The method of claim 1, wherein the hierarchical key system associates access control rules with a respective encrypted data object of the plurality of encrypted data objects. ### Claim 8 (depends on 1) The method of claim 1, wherein each node of the plurality of nodes corresponds to a different virtual machine of a plurality of virtual machines. ### Claim 9 A computing system comprising: a secure object store comprised of a plurality of data objects residing on a plurality of nodes; and a hardware processor to execute instructions to implement a hierarchical key structure, wherein the hierarchical key structure includes: a Node Key Encryption Key, wherein the Node Key Encryption Key is associated with a given node of a plurality of nodes; and a plurality of Data Encryption Keys, each Data Encryption Key corresponding to a respective data object of the plurality of data objects, wherein the hardware processor to execute the instructions to: generate the plurality of Data Encryption Keys using the Node Key Encryption Key; encrypt the plurality of data objects using the Data Encryption Keys to provide a plurality of encrypted data objects to be stored on the given node, wherein each data object of the plurality of data objects is encrypted by a respective Data Encryption Key, is associated with a different user of a plurality of users, and contains data representing a level of access of the associated user; and access an encrypted data object of the plurality of encrypted data objects using the Node Key Encryption Key and a selected Data Encryption Key of the Data Encryption Keys. ### Claim 10 (depends on 9) The computing system of claim 9, wherein the secure object store comprises an identity store. ### Claim 11 (depends on 9) The computing system of claim 9, wherein: a subset of the nodes is grouped to form a cluster; and the hierarchical key system includes a Storage Class Key Encryption Key encrypted using the Node Key Encryption Key and from which the Data Encryption Keys of the data objects residing on the subset of nodes are encrypted. ### Claim 12 (depends on 11) The computing system of claim 11, wherein the Storage Class Key Encryption Key and the Data Encryption Keys are used to share data across a plurality of nodes within the cluster. ### Claim 13 (depends on 9) The computing system of claim 9, wherein the Node Key Encryption Key and the Data Encryption Key are unlocked using one of multiple unlock protocols. ### Claim 14 (depends on 13) The computing system of claim 13, wherein the unlock protocols include a key splitting unlock protocol, a stable system values unlock protocol, and a trusted platform module unlock protocol. ### Claim 15 (depends on 9) The computing system of claim 9, wherein each Node Key Encryption Key of the plurality of Node Key Encryption Keys associates access control rules with a respective encrypted data object of the plurality of encrypted data objects. ### Claim 16 A method for use in a computing system, comprising: hosting a secure object store including a plurality of data objects on a plurality of nodes of a computing system; securing the secure object store using a hierarchical key system including: encrypting a given Node Key Encryption Key of a plurality of Node Key Encryption Keys, wherein the given Node Key Encryption Key is associated with a given node of the plurality of nodes; and encrypting a plurality of Data Encryption Keys from the given Node Key Encryption Key, wherein each Data Encryption Key of the plurality of Data Encryption Keys corresponds to a respective data object of the plurality of data objects, each data object of the plurality of data objects is encrypted by a respective Data Encryption Key of the plurality of Data Encryption Keys to provide a corresponding encrypted data object of a plurality of encrypted data objects, each data object of the plurality of data objects is associated with a different user of a plurality of users, and each data object of the plurality of data objects contains data representing a level of access of the associated user. ### Claim 17 (depends on 16) The method of claim 16, wherein the secure object store comprises an identity store. ### Claim 18 (depends on 16) The method of claim 16, further comprising: grouping a subset of the nodes in a cluster; and wherein securing the secure object store includes: generating a Storage Class Key Encryption Key; encrypting the Storage Class Key Encryption Key under the Node Key Encryption Key; and generating a second plurality of Data Encryption Keys from the Storage Class Key Encryption Key. ### Claim 19 (depends on 18) The method of claim 18, wherein the Storage Class Key Encryption Key and the second plurality of Data Encryption Keys are used to share data across a plurality of nodes within the cluster. ### Claim 20 (depends on 16) The method of claim 16, further comprising accessing a given encrypted data object of the plurality of encrypted data objects, including unlocking the given encrypted data object using the Node Key Encryption Key and a Data Encryption Key of the plurality of Data Encryption Keys in one of multiple unlock protocols. ### Claim 21 (depends on 16) The method of claim 16, wherein each Node Encryption Key of the plurality of Node Key Encryption Keys associates access control rules with a respective encrypted data object of the plurality of encrypted data objects.