Distributing Keys for Decrypting Client Data

A system comprising:

• a processor;
• and
• a non-transitory computer-readable medium communicatively coupled to the processor,
• wherein the processor is configured to execute program code stored to the non-transitory computer-readable medium for performing operations comprising:
• storing a static key portion at a server for creating combined encryption keys for multiple clients,
• generating a first session key portion for a first session with a first remote client and a first client key portion for the first remote client,
• encrypting first client data received from the first remote client during the first session using a first combined encryption key generated from the static key portion, the first session key portion, and the first client key portion,
• generating a second session key portion for a second session with a second remote client and a second client key portion for the second remote client,
• encrypting second client data received from the second remote client during the second session using a second combined encryption key generated from the static key portion, the second session key portion, and the second client key portion,
• providing the first client key portion to the first remote client and the second client key portion to the second remote client and deleting the first and second client key portions from the server, and
• subsequent to deleting the first and second client key portions, invalidating the static key portion responsive to determining that a security breach has occurred with respect to the server during the first and second sessions, wherein invalidating the static key portion invalidates the first and second combined encryption keys.

A non-transitory computer-readable medium embodying program code executable by a processing device, the program code comprising:

• program code for storing a static key portion at a server for creating combined encryption keys for multiple clients;
• program code for generating a first session key portion for a first session with a first remote client and a first client key portion for the first remote client;
• program code for encrypting first client data received from the first remote client during the first session using a first combined encryption key generated from the static key portion, the first session key portion, and the first client key portion;
• program code for generating a second session key portion for a second session with a second remote client and a second client key portion for the second remote client;
• program code for encrypting second client data received from the second remote client during the second session using a second combined encryption key generated from the static key portion, the second session key portion, and the second client key portion;
• program code for providing the first client key portion to the first remote client and the second client key portion to the second remote client and deleting the first and second client key portions from the server;
• and
• program code for invalidating, subsequent to deleting the first and second client key portions, the static key portion responsive to determining that a security breach has occurred with respect to the server during the first and second sessions, wherein invalidating the static key portion invalidates the first and second combined encryption keys.