Secure object access

A security system to provide access by a requester to an encrypted data object stored in an object store, the requester being authenticated by the object store, the system comprising:

• a first interface to communicate with the object store via which is received the encrypted object having associated an object identifier, and an identifier of the requester;
• a key derivation system to generate first and second cryptographic keys, the first key being used by the security system to decrypt the object;
• an encrypter to re-encrypt the object based on the second key;
• a second interface to communicate with the requester;
• wherein each of the first and second keys are based on the object identifier, the requester identifier and a secret key portion generated by the security system, the secret key portion being different for each of the first and second keys, and
• wherein the re-encrypted object is provided to the object store via the first interface for access by the requester, the system further comprising:
• an access control system including a challenge generator to further authenticate the requester based on a response to the challenge received via the second interface,
• wherein the second interface is further responsive to the access control system to communicate the secret key portion for the second key to the requester.