Encrypting data records and processing encrypted records without exposing plaintext

A computer-implemented method for generating and distributing keys, comprising:

• generating a first keyset based on a first master key;
• distributing the first keyset to a plurality of client devices;
• receiving, from a key issuer, a rotation key, wherein the rotation key is issued in response to change in a number of the plurality of the client devices;
• generating a second keyset based on the first master key and the rotation key;
• and
• distributing the second keyset to the plurality of client devices.

A non-transitory, computer-readable medium storing a set of instructions that, when executed by a processor, cause:

• generating a first keyset based on a first master key;
• distributing the first keyset to a plurality of client devices;
• receiving, from a key issuer, a rotation key, wherein the rotation key is issued in response to change in a number of the plurality of the client devices;
• generating a second keyset based on the first master key and the rotation key;
• and
• distributing the second keyset to the plurality of client devices.

A system of generating and distributing keys, the system comprising:

• a processor;
• a memory operatively connected to the processor and storing instructions that, when executed by the processor, cause:
• generating a first keyset based on a first master key;
• distributing the first keyset to a plurality of client devices;
• receiving, from a key issuer, a rotation key, wherein the rotation key is issued in response to change in a number of the plurality of the client devices;
• generating a second keyset based on the first master key and the rotation key;
• and
• distributing the second keyset to the plurality of client devices.