Secure high scale cryptographic computation through delegated key access

A computer-implemented method for performing a cryptographic operation by a compute service in a high-trust environment comprising the compute service and a key storage service, the method comprising:

• receiving, from a user device, a user request for performing a cryptographic operation on at least a portion of a large-scale dataset, the user request including a user token associated with a user of the user device;
• sending, to the key storage service, a cryptographic key access request corresponding to the received user request, the cryptographic key access request including data representative of the user token and/or a compute service token, wherein the key storage service is configured to process the user token and/or compute service token for determining whether the user has permission to have the cryptographic operation performed and/or whether to grant the compute service access to data representative of the cryptographic key associated with the cryptographic operation of the user request when user has permission;
• in response to the key storage service granting cryptographic access to the compute service, performing the steps of:
• receiving, from the key storage service, data representative of the requested cryptographic key and the cryptographic algorithm associated with the cryptographic operation of the user request;
• cryptographically processing the request portion of the large-scale dataset based on the received cryptographic key and cryptographic algorithm;
• and
• sending, to the user device, a user response indicating the portion of the large-scale dataset has been cryptographically processed;
• in response to the key storage service determining user does not have permission and/or denying cryptographic key access to the compute service based on the user token and/or compute service token, sending, to the user device, a user response indicating denial of the user request.

A computer-implemented method for performing a cryptographic operation by a key storage service in a high-trust environment comprising a compute service and the key storage service, the method, performed by the key storage service, comprising:

• receiving, from the compute service, a cryptographic key access request corresponding to a user request for performing a cryptographic operation on at least a portion of a large-scale dataset, the user request including a user token associated with a user of the user device, the cryptographic key access request including data representative of the user token and/or a compute service token;
• processing the user token and/or compute service token to determine whether the user has permission to have the cryptographic operation performed and/or whether to grant the compute service access to data representative of the cryptographic key associated with the cryptographic operation of the user request when user has permission;
• in response to the key storage service granting access to the compute service, sending, from the key storage service, data representative of the requested cryptographic key and the cryptographic algorithm associated with the cryptographic operation of the user request, wherein the compute service cryptographically processes the portion of the large-scale dataset based on the received cryptographic key and cryptographic algorithm.