Label-based double key encryption

A method performed by or on behalf of a connectable application to enhance confidentiality protection of sensitive data, the method comprising:

• getting a content key which is a symmetric encryption key;
• symmetrically encrypting the sensitive data using the content key, thereby producing content-key-encrypted sensitive data;
• obtaining a user public key from a user key management service;
• asymmetrically encrypting the content key using the user public key, thereby producing a user-key-encrypted content key that is decryptable using a user private key that corresponds to the user public key;
• and
• asymmetrically encrypting the user-key-encrypted content key using a cloud service provider key managed by a cloud service provider, thereby producing a double-encrypted content key;
• whereby confidentiality of the sensitive data is protected by using at least three levels of encryption and also by utilizing keys which as a set are managed by at least two key management entities.

A computer-readable storage medium configured with data and instructions which upon execution by a processor cause a computing system to perform a method to enhance confidentiality protection of sensitive data, the method comprising:

• encrypting the sensitive data using a content key, thereby producing content-key-encrypted sensitive data;
• obtaining a user public key from a user key management service;
• asymmetrically encrypting the content key using the user public key, thereby producing a user-key-encrypted content key that is decryptable using a user private key that corresponds to the user public key;
• and
• asymmetrically encrypting the user-key-encrypted content key using a cloud service provider key managed by a cloud service provider, thereby producing a double-encrypted content key;
• whereby confidentiality of the sensitive data is protected by using at least three levels of encryption and also by utilizing keys which as a set are managed by at least two key management entities.