Hierarchical key management system

A server for data encryption, comprising:

• one or more memories storing processor-executable code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the server to:
• receive, at the server, a first request from a first user, the first request for encryption of a set of data;
• transmit, to a key management system, a second request for a data encryption key associated with the set of data indicated via the first request, the key management system comprising a key hierarchy for data encryption and decryption;
• receive, from the key management system and in response to the second request, the data encryption key being associated with encrypting the set of data and a reference of a namespace key, the namespace key being associated with a different level in the key hierarchy of the key management system than a level of the data encryption key in the key hierarchy of the key management system;
• and
• store, at the server, an encrypted version of the set of data, the data encryption key, and the reference of the namespace key based at least in part on receiving the data encryption key from the key management system.

A non-transitory computer-readable medium storing code for data encryption, the code comprising instructions executable by one or more processors to:

• receive, at a server, a first request from a first user, the first request for encryption of a set of data;
• transmit, to a key management system, a second request for a data encryption key associated with the set of data indicated via the first request, the key management system comprising a key hierarchy for data encryption and decryption;
• receive, from the key management system and in response to the second request, the data encryption key being associated with encrypting the set of data and a reference of a namespace key, the namespace key being associated with a different level in the key hierarchy of the key management system than a level of the data encryption key in the key hierarchy of the key management system;
• and
• store, at the server, an encrypted version of the set of data, the data encryption key, and the reference of the namespace key based at least in part on receiving the data encryption key from the key management system.