Methods, systems and computer program products for rotating cryptographic keys for encrypted files

A method for rotating cryptographic keys to revoke access to encrypted data stored on a remote server, the method comprising:

• obtaining, from the remote server, at least one first cryptographic key from a key store associated with a digital storage service provider (DSSP), wherein the key store is stored on the remote server;
• generating at least one second cryptographic key at a user device;
• obtaining a first chunk of data from an encrypted file stored on the remote server, the first chunk of data being at least a portion of the encrypted file;
• decrypting the obtained first chunk of data from the encrypted file using the at least one first cryptographic key to provide a decrypted first chunk of data;
• re-encrypting the decrypted first chunk of data from the encrypted file using the at least one second cryptographic key to provide a re-encrypted first chunk of data;
• uploading the re-encrypted first chunk of data to the remote server from non-persistent storage on the user device;
• repeating the obtaining, decrypting and re-encrypting chunks of the encrypted file until it is determined that an entire encrypted file has been decrypted and re-encrypted;
• combining all re-encrypted chunks of the encrypted file at the remote server when it is determined that the entire encrypted file has been decrypted and re-encrypted to provide a reassembled encrypted file that is associated with the at least one second cryptographic key;
• updating the remote server with the reassembled encrypted file associated with the at least one second cryptographic key;
• storing the at least one second cryptographic key in place of the at least one first cryptographic key;
• and
• performing a clean up process at the user device and/or the remote server, the clean up process including at least removing any first cryptographic keys from the user device and/or the server and removing all copies or portions of copies of the encrypted file associated with the first cryptographic keys from the server and/or the user device.

At least one non-transitory machine-readable medium comprising a set of instructions executable on at least one computing device to cause the at least one computing device to rotate cryptographic keys to revoke access to encrypted data stored on a remote server, the set of instructions to:

• obtain, from the remote server, at least one first cryptographic key from a key store associated with a digital storage service provider (DSSP), wherein the key store is stored on the remote server;
• generate at least one second cryptographic key at a user device;
• obtain a first chunk of data from an encrypted file stored on the remote server, the first chunk of data being at least a portion of the encrypted file;
• decrypt the obtained first chunk of data from the encrypted file using the at least one first cryptographic key to provide a decrypted first chunk of data;
• re-encrypt the decrypted first chunk of data from the encrypted file using the at least one second cryptographic key to provide a re-encrypted first chunk of data;
• upload the re-encrypted first chunk of data to the remote server from non-persistent storage on the user device;
• repeat the obtaining, decrypting and re-encrypting chunks of the encrypted file until it is determined that an entire encrypted file has been decrypted and re-encrypted;
• combine all re-encrypted chunks of the encrypted file at the remote server when it is determined that the entire encrypted file has been decrypted and re-encrypted to provide a reassembled encrypted file that is associated with the at least one second cryptographic key;
• update the remote server with the reassembled encrypted file associated with the at least one second cryptographic key;
• store the at least one second cryptographic key in place of the at least one first cryptographic key;
• and
• perform a clean up process at the user device and/or the remote server, the clean up process including at least removing any first cryptographic keys from the user device and/or the server and remove all copies or portions of copies of the encrypted file associated with the first cryptographic keys from the server and/or the user device.