Secure Transport of Encrypted Virtual Machines with Continuous Owner Access

In a computing environment, a system for managing encrypted datasets, the system comprising

• one or more processors;
• and
• one or more computer readable media, wherein the one or more computer readable media comprise computer executable instructions that when executed by at least one of the one or more processors cause they system to perform the following:
• obtaining a first decryption key, the first decryption key being configured to be used to decrypt an encrypted dataset that has been encrypted using a first encryption mechanism, the first encryption mechanism being associated with the first decryption key that can be used to decrypt the dataset;
• encrypting the first decryption key with a second encryption mechanism, the second encryption mechanism being associated with a second decryption key used by a first entity, such that the second decryption key can be used by the first entity to decrypt the dataset by first decrypting the first key encrypted key using the second decryption key, and then using the decrypted first key to decrypt the dataset;
• encrypting the first decryption key with a third encryption mechanism, the third encryption mechanism being associated with a third decryption key used by a second entity, such that the third decryption key can be used by the second entity to decrypt the dataset by first decrypting the first key encrypted key using the third decryption key, and then using the decrypted first key to decrypt the dataset;
• creating a package comprising at least the first decryption key encrypted with the second encryption method and the first decryption key encrypted with the third encryption method;
• signing the package with a guardian signature;
• and
• signing the package with a signature created from the first decryption key.

One or more physical computer readable storage media comprising computer executable instructions that when executed by at least one of the one or more processors cause they system to perform the following:

• obtaining a first decryption key, the first decryption key being configured to be used to decrypt an encrypted dataset that has been encrypted using a first encryption mechanism, the first encryption mechanism being associated with the first decryption key that can be used to decrypt the dataset;
• encrypting the first decryption key with a second encryption mechanism, the second encryption mechanism being associated with a second decryption key used by a first entity, such that the second decryption key can be used by the first entity to decrypt the dataset by first decrypting the first key encrypted key using the second decryption key, and then using the decrypted first key to decrypt the dataset;
• encrypting the first decryption key with a third encryption mechanism, the third encryption mechanism being associated with a third decryption key used by a second entity, such that the third decryption key can be used by the second entity to decrypt the dataset by first decrypting the first key encrypted key using the third decryption key, and then using the decrypted first key to decrypt the dataset;
• creating a package comprising at least the first decryption key encrypted with the second encryption method and the first decryption key encrypted with the third encryption method;
• signing the package with a guardian signature;
• and
• signing the package with a signature created from the first decryption key.