Multiple authority key derivation

A computer-implemented method for providing electronic data security, comprising:

• under control of one or more computer systems configured with executable instructions,
• receiving a root key from a first authority;
• deriving, by a second authority, a plurality of keys to form a key hierarchy that comprises the root key and a plurality of levels of subordinate keys, the subordinate keys in each of the plurality of levels each being derived based at least in part on both another key of the derived keys and data associated with a restriction applied by the first authority and the second authority, the restriction being based on at least one of date, time, virtual computer system service, or geographical region, wherein a particular level of the plurality of levels of subordinate keys corresponds to a particular combination of one or more restrictions applied by the first authority and the second authority to a subordinate key in the particular level;
• and
• causing the performance of one or more cryptographic operations based at least in part on at least a subset of the derived plurality of keys.

A key processing system, comprising:

• one or more processors;
• and
• memory including instructions executable by the one or more processors to cause the key processing system to at least;
• obtain information corresponding to a key used to encrypt data, the information corresponding to a plurality of restrictions associated with the key, a first restriction of the plurality of restrictions having been applied by a first authority and a second restriction of the plurality of restrictions having been applied by a second authority, the plurality of restrictions individually being based on at least one of date, time, virtual computer system service, or geographical region;
• without prior access to the key, derive the key based at least in part on the obtained information and a different key, wherein the derived key is associated with a lower level of a key hierarchy, the lower level being associated with a first number of restrictions that is greater than a second number of restrictions associated with a higher level of a key hierarchy, the higher level of the key hierarchy being associated with the different key;
• and
• provide the derived key for decryption of the data.

A non-transitory computer-readable storage medium having stored therein instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

• obtain key-derivation material associated with a key used to encrypt data, the key-derivation material corresponding to a restriction associated with the key, the restriction applied by a first authority and a second authority, the restriction being based on at least two of date, time, virtual computer system service, or geographical region wherein the obtained key-derivation material is metadata for the encrypted data from a data storage system that associates the encrypted data with the metadata;
• obtain a different key by identifying, based at least in part on information in a data store that associates information identifying the different key with the encrypted data, a key that is at least both accessible to the computer system and usable to derive the key based at least in part on at least a portion of the key-derivation material;
• without prior access to the key, generate the key based at least in part on the obtained key-derivation material and the different key;
• decrypt the data based at least in part on the generated key;
• and provide access to the decrypted data.