Hidden link dynamic key manager for use in computer systems with database structure for storage of encrypted data and method for storage and retrieval of encrypted data

A computer readable data transmission medium containing a data structure for encrypted data, the data structure comprising:

• at least one encryption key, the data entity having at least one searchable attribute;
• at least one encryption key identification stored in association with the data entity and for identifying the encryption key, wherein the encryption key identification is encrypted by a system key;
• and
• a system key common name also stored in association with the data entity for identifying the system key, wherein the system key common name is encrypted by a master key.

A method for storage and retrieval of encrypted data, the method comprising:

• encrypting a data entity with an encryption key having an encryption key identification;
• storing the encrypted data entity;
• encrypting the encryption key identification with a system key having a system key common name;
• encrypting the system key common name with a master key;
• and
• storing the encrypted encryption key identification and the encrypted system key common name in association with the encrypted data entity.

A method for storage and retrieval of encrypted data, the method comprising:

• encrypting a plurality of data entities with a rotating and dynamic encryption key having an encryption key identification;
• storing the encrypted data entities;
• encrypting the encryption key identification with a system key having a system key identification;
• encrypting the system key identification with a master key;
• and
• storing the encrypted encryption key identification and the encrypted system key identification with the encrypted data entity;
• and
• creating and rotating to a new encryption key upon occurrence of a desired rotation event.

A method of providing a secure environment for the storage of information, the method comprising:

• encrypting a data entity with an encryption key having a randomly generated encryption key identification;
• storing the encrypted data entity;
• encrypting the encryption key identification with a system key having a system key identification;
• encrypting the system key identification with a master key;
• and
• storing the encrypted encryption key identification and the encrypted system key identification in association with the encrypted data entity.

A method of encrypting and storing a data entity, the method comprising the steps of:

• encrypting a data entity using a first encryption key having a first encryption key identification;
• encrypting the first encryption key identification using a second encryption key having a second encryption key identification;
• encrypting the second encryption key identification using a third encryption key;
• storing the encrypted data entity, the encrypted first encryption key identification, and the encrypted second encryption key identification together;
• encrypting the first encryption key using a fourth encryption key having a fourth encryption key identification;
• encrypting the fourth encryption key identification using the third encryption key;
• encrypting the second and fourth encryption keys using the third encryption key;
• storing the unencrypted first encryption key identification, the encrypted fourth encryption key identification, and the encrypted first encryption key together;
• storing the unencrypted second encryption key identification and the encrypted second encryption key together;
• storing the unencrypted fourth encryption key identification and the encrypted fourth encryption key together;
• and
• securing the third encryption key.

A method of encrypting, storing, and decrypting a data entity, the method comprising the steps of:

• encrypting and storing the data entity as follows—
• encrypting a data entity using a first encryption key having a first encryption key identification,
• encrypting the first encryption key identification using a second encryption key having a second encryption key identification,
• encrypting the second encryption key identification using a third encryption key,
• storing the encrypted data entity, the encrypted first encryption key identification, and the encrypted second encryption key identification together,
• encrypting the first encryption key using a fourth encryption key having a fourth encryption key identification,
• encrypting the fourth encryption key identification using the third encryption key,
• encrypting the second and fourth encryption keys using the third encryption key,
• storing the unencrypted first encryption key identification, the encrypted fourth encryption key identification, and the encrypted first encryption key together,
• storing the unencrypted second encryption key identification and the encrypted second encryption key together,
• storing the unencrypted fourth encryption key identification and the encrypted fourth encryption key together,
• securing the third encryption key;
• and
• decrypting the data entity as follows—
• accessing the third encryption key and using the third encryption key to decrypt the second encryption key identification and the fourth encryption key identification,
• identifying the second encryption key using the decrypted second encryption key identification,
• using the second encryption key to decrypt the first encryption key identification,
• identifying the first encryption key using the decrypted first encryption key identification,
• identifying the fourth encryption key using the decrypted fourth encryption key identification,
• using the fourth key to decrypt the first encryption key, and
• using the decrypted first encryption key to decrypt the data entity.