System and a method for management of confidential data

A system for management of confidential data, the system comprising:

• an untrusted cloud service for storing encrypted data,
• a cryptographic key service comprising two or more hardware cryptographic key servers (Si) comprising at least a first and a second cryptographic key server, wherein each of said two or more cryptographic key servers (Si) independently generates one or more different cryptographic key(s) (Kj), wherein the first cryptographic key server (Si) produces at least one cryptographic key(s) (Kj), not produced by any other cryptographic key servers from the two or more hardware cryptographic key servers (Si) and said second cryptographic key server (Si) produces at least one or more additional cryptographic key(s) (Kj) not produced by any other cryptographic key servers from the two or more said first cryptographic key servers (Si), wherein no single cryptographic key server from the two or more cryptographic key servers (Si) possesses knowledge of all cryptographic key(s) (Kj) generated by said cryptographic key service;
• wherein in response to receiving a request for encryption or decryption of data files from one or more client devices, the data files comprising confidential data and the request comprising information regarding the data files, each of said two or more cryptographic key servers (Si) are further configured to compute one or more file encryption key(s) (KF_j) on the basis of the information regarding the data files, wherein the information comprises metadata identifying the data files, and each of the one or more file encryption key(s) (KF_j) are computed at one of the respective two or more hardware cryptographic key servers (Si);
• wherein each of the one or more file encryption key(s) (KF_j) created at a specific one of the two or more cryptographic key servers (S1) are required to be computed using the cryptographic key (Kj) generated by that specific cryptographic key server (Si) and at least two different file encryption keys (KF_j) from the one or more file encryption key(s) (KF_j) computed by at least two different servers from the two or more hardware cryptographic key servers (Si) are required to encrypt and decrypt said data files which are stored on the cloud service;
• and
• one or more client devices, wherein each client device of the one or more client devices communicates with the cryptographic key service in order provide the data files and in order to request encryption or decryption of the data files;
• wherein the two or more hardware cryptographic servers (Si) of the cryptographic key service use the two or more file encryption keys (KF_j) to:
• in a distributed manner, encrypt the data files and provide the encrypted data files to the cloud service, and, in a distributed manner, decrypt data files retrieved from the cloud service that were encrypted using the two or more file encryption keys (KF_j), wherein the two or more hardware cryptographic key servers (Si) of the cryptographic key service generate one or more new cryptographic key(s) (Kj′) and generate new file encryption key(s) (KF_j′) based on the new cryptographic key(s) (Kj′) and re-encrypt the data files, encrypted with the two or more file encryption keys, stored in the cloud service using the new file encryption key(s) (KF_j′) without decrypting the encrypted data files.