System-generated data set encryption key

Abstract

generating a unique data encryption key for a dataset by allocating a dataset associated with a security policy, the security policy specifying a key encryption key (KEK) label; retrieving the KEK label from the security policy; storing the KEK label as metadata for the dataset; opening the dataset for first write; generating a data encryption key (DEK); retrieving the KEK from a key store according to the KEK label; encrypting the DEK using the KEK; storing the encrypted DEK as metadata for the dataset; and encrypting the dataset using the DEK.

Description

[Technical field]

[0001] This disclosure relates generally to generating data encryption keys (DEKs). This disclosure relates specifically to system-generated DEKs for files and datasets and enabling efficient rekeying of files and datasets. As used herein, the term "dataset" refers broadly to digital files and datasets. [Background technology]

[0002] Data encryption is an impactful method for reducing the risk of data leakage. Deploying an encryption strategy can be complex. Enterprise organizations are increasingly interested in using data set level encryption, where the underlying operating system performs the encryption on behalf of each application, without requiring application modifications. Enterprise security architects who deploy data set level encryption on behalf of an enterprise organization may be responsible for determining new policies and procedures related to data encryption. For example, some security policies require encrypted data to be periodically re-encrypted with a new DEK. Summary of the Invention

[0003] The following presents a summary to provide a basic understanding of one or more embodiments of the present disclosure. This summary is not intended to identify key or critical elements or to delineate the scope of any particular embodiments or the scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description that is presented later. In one or more embodiments described herein, a device, a system, a computer-implemented method, an apparatus, or a computer program product, or a combination thereof, enables generating a data encryption key (DEK) for a data set.

[0004] An aspect of the present invention is Disclosed are methods, systems, and computer-readable media associated with improving the ability to generate a unique data encryption key for a dataset by assigning a dataset associated with a security policy, the security policy specifying a Key Encryption Key (KEK) label, obtaining the KEK label from the security policy, storing the KEK label as metadata for the dataset, opening the dataset for first write, generating a Data Encryption Key (DEK), obtaining a KEK from a key store according to the KEK label, encrypting the DEK using the KEK, storing the encrypted DEK as metadata for the dataset, and encrypting the dataset using the DEK. [Brief description of the drawings]

[0005] The above and other objects, features, and advantages of the present disclosure will become more apparent through a more detailed description of several embodiments of the present disclosure in the accompanying drawings, in which like reference numerals generally refer to like components of the embodiments of the present disclosure.

[0006] [Figure 1] 1 provides a schematic diagram of a functional block diagram of a system according to an embodiment of the present invention;

[0007] [Diagram 2] 1 provides a schematic diagram of a system according to one embodiment of the present invention.

[0008] [Diagram 3] 1 provides a flow chart illustrating an operational key generation sequence according to one embodiment of the present invention.

[0009] [Figure 4] 1 provides a flow chart illustrating an operational read sequence according to one embodiment of the present invention.

[0010] [Diagram 5] 5 provides a flowchart illustrating a target of an operational dataset rekey operation, where the source read sequence is identified according to FIG. 4, in accordance with one embodiment of the present invention.

[0011] [Figure 6] 1 illustrates a cloud computing environment according to an embodiment of the present invention.

[0012] [Figure 7] 3 illustrates abstraction model layers according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Some embodiments will now be described in more detail with reference to the accompanying drawings, in which embodiments of the present disclosure are illustrated, however the present disclosure may be implemented in various ways and therefore should not be construed as limited to the embodiments disclosed herein.

[0014] In one embodiment, one or more components of the system may use hardware and / or software to solve problems that are highly technical in nature (e.g., opening an encrypted data set, verifying the authentication of a user to a KEK label, retrieving a KEK associated with a KEK label from a key store, providing the KEK to a storage management subsystem (SMS), reading an encrypted DEK from metadata of the data set, decrypting the DEK using the KEK, and then decrypting the data set using the decrypted DEK, etc.). These solutions are not abstract and cannot be performed as a set of mental activities by a human being due to, for example, the processing power required to facilitate the generation of an encryption key. Furthermore, some of the processes performed may be performed by a dedicated computer for performing defined tasks related to memory operations. For example, a dedicated computer may be used to perform tasks related to the generation of an encryption key, etc.

[0015] Dataset-level encryption refers to policy-based, application-transparent encryption of data stored in a dataset. Typically, an encryption key owner is responsible for creating and maintaining keys within an enterprise organization. The encryption key owner generates a DEK that is persistently stored in a key store identified by a unique key label. To enable dataset-level encryption for a set of datasets, the key label may be added to a security policy associated with the datasets that are intended to be encrypted. To control access to plaintext data, a security administrator may grant data owner permissions to a dataset as well as the DEK label of the dataset associated with that dataset. To restrict access to plaintext data, a security administrator may grant storage administrator permissions only to the dataset but not to the DEK label associated with the dataset. When a data owner with permissions to the dataset and the DEK label writes or reads to the dataset, the DEK is used to encrypt or decrypt the data. A storage administrator with permissions only to the dataset can allocate and manage the dataset, but does not have permissions to the DEK label and therefore cannot write or read to the dataset and therefore cannot access the plaintext data.

[0016] As data breaches become more prevalent, the amount of data that organizations encrypt continues to grow. With data set-level encryption, the process of allocating a new encrypted data set typically requires an application outage. The process of re-encrypting an existing encrypted data set with a new DEK typically requires an additional application outage. Based on how frequently data sets need to be re-encrypted with a new DEK, as defined in security policies, the number of outages can impact daily business operations.

[0017] A typical process for re-encrypting a data set with a new DEK, also referred to as a rekey operation, involves a number of steps. In this example, the DEK label is provided to the Storage Management Subsystem (SMS) through a data set security policy defined by a security administrator, which may be verified by a System Authentication Facility (SAF). Regardless of how the DEK label is provided to the system, similar steps are required. The process involves at least eight steps: generating a new DEK with a new key label, identifying the security policies of all data sets associated with the old DEK label, updating the security policies of said data sets with the new DEK label, identifying all data sets encrypted with the old DEK label, assigning the new data sets to be associated with the newly updated data set security policy, copying data from the old data set to the new data set, deleting the old data set, and archiving or setting an expiration date for the old DEK.

[0018] Aspects of the present invention disclose methods, systems, and computer-readable media associated with improving the ability to rotate a Data Encryption Key (DEK) by enabling an operating system to generate a unique DEK when opening a first data set that is encrypted with a Key Encryption Key (KEK) and then stored in the metadata of the data set it encrypts. This process involves a security administrator specifying a KEK label instead of a DEK label in the security policy of the data set. A System Authentication Facility (SAF) can then verify the KEK label as well as the user's authorization to access the KEK label.

[0019] A data owner or storage administrator allocates a dataset that is associated with the dataset's security policy. The SAF verifies the user's authorization to the dataset as well as a KEK label and obtains a KEK label from the associated dataset's security policy. The disclosed method then stores the obtained KEK label in the dataset's metadata. When the data owner opens the newly allocated dataset for the first write, the SMS invokes the SAF to verify the user's authorization to the KEK label, obtain the KEK from the key store, generate a unique DEK, encrypt the DEK using the KEK, and store the encrypted DEK in the dataset's metadata. The method then encrypts the dataset using the DEK. The encryption includes writing the encrypted data to the space allocated to the dataset.

[0020] Aspects of the present invention disclose methods, systems, and computer readable media associated with enabling the ability to read an encrypted data set by opening the encrypted data set, obtaining a KEK associated with the KEK label from a key store according to the KEK label, obtaining an encrypted Data Encryption Key (DEK) from metadata for the data set, decrypting the DEK using the KEK, decrypting the data set using the DEK, and providing a user access to the data of the data set.

[0021] To complete a dataset rekey operation, the data owner simply copies the data from the old encrypted dataset to the new dataset which transparently encrypts the data with the newly generated DEK. The end result is that the new dataset is encrypted with the new DEK and both the KEK label and the encrypted DEK are stored in the new dataset's metadata. The DEK is unique to that dataset and is never stored outside of the dataset's metadata.

[0022] Aspects of the present invention disclose methods, systems, and computer-readable media associated with improving the ability to copy an encrypted dataset by assigning a target dataset associated with a security policy, obtaining a KEK label from the security policy, storing the KEK label as metadata of the target dataset, opening the target dataset for a first write, generating a Data Encryption Key (DEK) for the target dataset, obtaining the KEK from a key store according to the KEK label, encrypting the DEK of the target dataset using the KEK, storing the encrypted DEK as metadata of the target dataset, and encrypting the source dataset as the target dataset using the DEK of the target dataset.

[0023] A typical rekey or key rotation process may include generating a new data encryption key (DEK) with a new DEK label, identifying security policies of all data sets associated with the old DEK label, updating the security policies of the data sets with the new DEK label, identifying all data sets encrypted with the old DEK label, assigning new data sets associated with the security policies of the newly updated data sets, copying data from the old data sets to the new data sets, deleting the old data sets, and archiving or expiring the old DEK. The process presents a significant burden of coordinating the rotation or rekey of all data sets encrypted using a single DEK. The disclosed method and program provide a simplified process for rekeying data sets and enabling staggered rekeying of data sets across a set of encrypted data sets.

[0024] In one embodiment, defining or allocating resources for a new dataset includes referencing a security policy for the dataset that includes a key encryption key (KEK) label rather than a data encryption key (DEK) label for the dataset. The KEK label refers to a KEK stored in a cryptographic key store. In this embodiment, when the dataset is first opened, the method obtains a KEK label from the security policy for the dataset and stores the KEK label as metadata for the dataset. The method generates a unique DEK for the dataset. The method obtains a KEK from the key store using the KEK label, encrypts the DEK using the KEK, and stores the encrypted DEK in metadata for the dataset. The method encrypts the dataset using the DEK and writes the encrypted dataset to the allocated storage location.

[0025] In one embodiment, copying an existing encrypted data set includes accessing an existing source data set for a data read operation and initially accessing a newly assigned target data set for a data write operation. In this embodiment, the newly assigned target data set is associated with the same data set security policy as the source data set and utilizes the same KEK label as the source data set. Opening an existing source data set for a read operation results in retrieving a KEK from a key store using a KEK label stored in the source data set's metadata, decrypting an encrypted DEK stored in the source data set's metadata using the KEK, and decrypting data from the source data set using the DEK. Opening a newly assigned target data set for a write (copy) operation results in retrieving a KEK from a key store using a KEK label stored in the target data set's metadata, generating a unique DEK for the target data set, encrypting the DEK using the KEK, storing the encrypted DEK in the target data set's metadata, encrypting data from the source data set using the newly generated DEK from the target data set, and writing the newly encrypted data to the target data set. Copying an existing encrypted source data set effectively rekeys the data set through the generation and use of a new DEK for the target data set without having to change the data set's security policy, KEK label, or key store.

[0026] In one embodiment, rekeying an existing encrypted data set in accordance with the data set's security policy requires only copying the existing data set to the new data set, including allocating the new data set in accordance with the policy and generating a new DEK for the new data set, encrypting the new DEK using the KEK associated with the KEK label stored in the data set's metadata, storing the encrypted DEK as metadata for the new data set, and then encrypting and writing the new data set using the DEK. In one embodiment, the rekey process is completed by deleting the old data set after copying.

[0027] Encryption of each data set utilizes a unique DEK encrypted by the KEK. A single KEK may be utilized as a shared KEK across the set of data sets. The combination of unique DEKs and a shared KEK allows for twisted rekeying of data sets because each rekeyed data set obtains a new unique DEK without a new KEK, eliminating the need to rekey all data sets at once and the attendant system disruptions associated with mass rekeying of data sets.

[0028] In one embodiment, the System Authentication Facility (SAF) contains a defined system-level dataset security policy that indicates whether a key label in the dataset security policy should be treated as a KEK label or a DEK label. On a newly allocated dataset, the key label is read from the dataset security policy and stored in the dataset metadata (e.g., encrypted cells) with an indicator designating the key label as a KEK label or a DEK label.

[0029] In one embodiment, a user (storage administrator) may be authenticated to access a dataset, but not the associated KEK label, allowing the storage administrator to manipulate the dataset as needed without allowing access to the data of the actual dataset. In one embodiment, a user of a dataset may have access to a KEK label and associated KEK, but may not have access to the KEK label and all datasets associated with the KEK. Since each KEK and KEK label may be reused across multiple datasets, verification of user authentication to the KEK label is necessary, but not sufficient to allow the user to access the dataset. Only users whose authentication to the dataset and KEK label has been verified have access to the data of the underlying dataset. In this embodiment, the method verifies each user for authentication to each of the associated datasets and associated KEK labels.

[0030] In one embodiment, Data Set-1, protected by a KEK-1 associated with a KEK-1 label and encrypted with a DEK-1, may be rekeyed, i.e., undergo encryption key rotation, through the following steps: a. Allocate new Dataset-2 associated with KEK-1 and KEK-1 label in accordance with the Dataset Security Policy of Dataset-1. b. Opening a new dataset-2 results in the generation of DEK-2. c. Encrypt DEK-2 using KEK-1. The DEK-2 and KEK-1 labels are stored with Dataset-2 as encryption metadata. d. Copy the data from the source dataset to the new dataset. DEK-1 is decrypted using KEK-1 associated with the KEK-1 label. The data in Dataset-1 is decrypted using DEK-1 and then encrypted using DEK-2.

[0031] Examples include appropriate steps via SMS for verification of user authorization for access to the data set and the KEK-1 label.

[0032] As used herein, SAF (System Authentication Facility), Key Store, SMS (Storage Management Subsystem), KEK (Key Encryption Key), DEK (Data Encryption Key), and Crypto Provider include software modules of the computing environment that are utilized by the disclosed encryption key change methods. CFHE (Cryptographic Function Hardware Engine) includes a hardware engine of the computing environment that is invoked to perform cryptographic functions in support of the disclosed key change methods.

[0033] 1 provides a functional block diagram illustrating the relationships between various system components of the disclosed embodiment. As shown in the figure, an SMS 12 receives a user data data set request 10. After receiving the user data set request 10, the SMS 12 opens an assigned existing data set and scans the data set's metadata for encryption key information (KEK label).

[0034] In one embodiment, for a new data set, the SMS allocates the data set according to a defined security policy for the data set. The security policy includes any KEK labels assigned to the data set and a list of users authorized to access the data set. The SAF also maintains a list of users authorized to access each KEK label. Upon allocation of the data set, the SMS stores the KEK label of the data set as part of the encryption metadata of the data set.

[0035] SMS 12 queries SAF 14 to verify the data set security policy authorizes the requesting user to access the data set and associated KEK label. After verifying user authorization for the data set and associated KEK label, SMS 12 passes the KEK label from the data set's metadata to crypto provider 16. Crypto provider 16 uses the KEK label to look up the KEK in key store 18. In one embodiment, crypto provider 16 passes the KEK to SMS 12.

[0036] In one embodiment, for a new data set, SMS 12 calls crypto provider 16 to generate a DEK for the data set, encrypt the DEK using the KEK, and use the DEK to encrypt the data set and write the data. The SMS stores the encrypted DEK as metadata in an encryption cell associated with the assigned data set.

[0037] For an existing data set, SMS 12 verifies the authorization of the requesting user for access to the data set and the KEK label, calls cryptographic provider 16 to decrypt the data set's DEK using the KEK, and then uses the DEK to decrypt the data set's data for access by user 10. In one embodiment, SMS 12 calls CFHE 20 to decrypt the data set using the decrypted DEK.

[0038] 2 provides a schematic diagram of exemplary network resources associated with the practice of the disclosed invention. The invention may be practiced in any processor of the disclosed elements that processes instruction streams. As shown in the figure, a network client device 110 wirelessly connects to the server subsystem 102. A client device 104 wirelessly connects to the server subsystem 102 via a network 114. The client devices 104 and 110 include a data set encryption key change program (not shown) along with sufficient computing resources (processor, memory, network, communication hardware) to execute the program. As shown in Figure 2, the server subsystem 102 includes a server computer 150. Figure 2 illustrates a block diagram of the components of the server computer 150 included in the network computer system 1000 in accordance with one embodiment of the present invention. It should be understood that Figure 2 is provided as an example of only one implementation and is not intended to suggest any limitation with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

[0039] Server computer 150 may include processor 154, memory 158, persistent storage 170, communication unit 152, input / output (I / O) interface 156, and communication fabric 140. Processor 154 may include a CFHE (not shown) for execution of dedicated cryptographic functions. Communication fabric 140 provides communication between cache 162, memory 158, persistent storage 170, communication unit 152, and input / output (I / O) interface 156. Communication fabric 140 may be implemented with any architecture designed to pass data and / or control information between a processor (e.g., a microprocessor, a communication and network processor, etc.), system memory, peripheral devices, and any other hardware components in the system. For example, communication fabric 140 may be implemented with one or more buses.

[0040] Memory 158 and persistent storage 170 are computer-readable storage media. In this embodiment, memory 158 includes random access memory (RAM) 160. In general, memory 158 may include any suitable volatile or non-volatile computer-readable storage medium. Cache 162 is a high-speed memory that enhances the performance of processor 154 by holding recently accessed and near recently accessed data from memory 158.

[0041] Program instructions and data used to practice embodiments of the present invention, such as encryption program 175, are stored in persistent storage 170 for execution and / or access by one or more of the respective processors 154 of server computer 150 via cache 162. In this embodiment, persistent storage 170 includes a magnetic hard disk drive. Alternatively, or in addition to a magnetic hard disk drive, persistent storage 170 may include a solid state hard drive, a semiconductor storage device, a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory, or other computer readable storage medium capable of storing program instructions or digital information.

[0042] The media used by persistent storage 170 may also be removable. For example, a removable hard drive may be used for persistent storage 170. Other examples include optical disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 170.

[0043] The communication unit 152 provides for communication with other data processing systems or devices, including resources of the client computing devices 104 and 110, in these examples. In these examples, the communication unit 152 includes one or more network interface cards. The communication unit 152 may provide communication using one or both of physical and wireless communication links. Software distribution programs and other programs and data used in the implementation of the present invention may be downloaded to the persistent storage 170 of the server computer 150 through the communication unit 152.

[0044] The I / O interface 156 allows for input and output of data with other devices that may be connected to the server computer 150. For example, the I / O interface 156 may provide a connection to an external device 190, such as a keyboard, a keypad, a touch screen, a microphone, a digital camera, or any other suitable input device, or a combination thereof. The external device 190 may also include portable computer-readable storage media, such as, for example, thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention, for example, the encryption program 175 on the server computer 150, may be stored on such portable computer-readable storage media and loaded into the persistent storage 170 via the I / O interface 156. The I / O interface 156 also connects to a display 180.

[0045] Display 180 provides a mechanism for displaying data to a user and may be, for example, a computer monitor. Display 180 may also function as a touch screen, such as the display of a tablet computer.

[0046] 3 provides a flowchart 300 illustrating exemplary operational steps for creating a new data set, according to one embodiment of the present invention. According to the flowchart 300, at block 310, the method of the encryption program 175, after a user request, allocates a new data set using parameters associated with the data set security policy, including the use of a KEK label for the data set and the KEK label itself. At block 320, the method obtains the KEK label from the data set security policy, and at block 330, the method stores the KEK label as encryption metadata for the data set.

[0047] At block 340, the method opens the newly allocated dataset for the initial write of data to the dataset. In conjunction with opening the dataset for the initial write, at block 350, the method generates, or has generated by the cryptographic provider, a DEK unique to the dataset.

[0048] At block 360, the method retrieves a KEK from the key store according to the KEK label of the data set. At block 370, the method encrypts the DEK of the data set using the retrieved KEK or has the cryptographic provider encrypt the DEK using the KEK. The method retains the DEK in volatile memory for encryption of the data of the data set, and at block 380, stores the encrypted DEK as metadata for the data set in an encryption metadata cell of the data set. At block 390, the method utilizes the DEK in the volatile memory to encrypt and write data to the assigned data set.

[0049] 4 provides a flowchart 400 illustrating example operations associated with practicing the present disclosure. At block 410, a storage management system (SMS) receives a user request to open an encrypted data set. After opening the data set, at block 420, the SMS retrieves a Key Encryption Key (KEK) label found in the metadata of the data set. The SMS may request verification of the user's authorization to access the data set and the KEK label in accordance with SAF policy.

[0050] In block 430, the SMS passes the KEK label associated with the data set to the cryptographic provider to obtain the KEK associated with the data set through the KEK label. The cryptographic provider looks up the KEK associated with the KEK label in a key store and passes the KEK to the SMS.

[0051] The SMS obtains the encrypted DEK from the metadata of the opened data set and decrypts the DEK using the KEK, in block 440. In one embodiment, the SMS uses the KEK to decrypt the DEK from the metadata of the data set.

[0052] At block 450, the method of encryption program 175 decrypts the data set using the DEK. In one embodiment, the SMS calls the CFHE to decrypt the data set using the DEK. At block 460, the method provides the user access to the decrypted data of the data set. The KEK label and the encrypted DEK remain in the metadata of the encrypted data set.

[0053] In one embodiment, after a data set has been initially encrypted using a DEK, with the DEK encrypted using a KEK, rekeying or rotating or changing the encryption key of the data set only requires copying the encrypted data set from its current data set assignment to a new data set assignment having the same KEK label. During the copy, the generation of a new DEK for the newly assigned data set occurs with the first write access of the data set to create the copy, so that the copy is encrypted using the new DEK while still being accessed using the original KEK. Alternatively, the SAF profile of the new data set may include a new KEK label resulting in a copy of the source data set encrypted with the new DEK, which is further encrypted using the new KEK.

[0054] Flowchart 500 of Figure 5 illustrates exemplary operational steps of encryption program 175 during data set copying and key rekeying. At block 510, the method of encryption program 175 allocates a target data set after a user request and copies the source data set using parameters associated with the target data set's security policy, including the use of a KEK label for the data set and the KEK label itself. The data set security policy of the source data set, including the KEK label of the source data set, is utilized for the target data set. At block 520, the method obtains the KEK label from the target data set's security policy, and at block 530, the method stores the KEK label as encryption metadata for the target data set.

[0055] At block 540, the method opens the allocated target dataset for an initial write of source data to the target dataset. In conjunction with opening the target dataset for an initial write, at block 550, the method generates, or has generated by the cryptographic provider, a DEK unique to the target dataset.

[0056] At block 560, the method retrieves a KEK from the key store according to the KEK label of the target data set. At block 570, the method encrypts the DEK of the target data set using the retrieved KEK. The method retains the DEK of the target data set in a volatile memory for encryption of the data set's data, and at block 580, stores the encrypted DEK of the target data set in the encryption metadata cell of the target data set as metadata of the target data set. The method of encryption program 175 follows the operational steps depicted in FIG. 4 and described above to open, decrypt, and read the data of the source data set. At block 590, the method utilizes the DEK in the volatile memory to encrypt and write data from the source data set to the assigned target data set. In one embodiment, the method follows the encryption and writing of the source data to the target data set by deleting the source data set from the persistent memory (not shown).

[0057] Although this disclosure includes a detailed description of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0058] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0059] The characteristics are as follows:

[0060] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without the need for human interaction with the service provider.

[0061] Broad network access: Capabilities are available over the network and are accessed through standard mechanisms that facilitate use by heterogeneous thin- or thick-client platforms (eg, cell phones, laptops, and PDAs).

[0062] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated according to demand. There is location independence in that consumers generally have no control or knowledge over the exact location of the provided resources, but it may be possible to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0063] Rapid Scalability: Capacity can be provisioned quickly and elastically, sometimes automatically, and can be quickly scaled out or quickly released and quickly scaled in. To the consumer, the capacity available for provisioning often appears unlimited, and can be purchased in any amount at any point in time.

[0064] Measurable Services: Cloud systems automatically control and optimize resource utilization by leveraging metering capabilities appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts) at a certain level of abstraction. Resource usage can be monitored, controlled, and reported, thereby providing transparency to both providers and consumers of the services utilized.

[0065] The service model is as follows:

[0066] Software as a Service (SaaS): The ability offered to the consumer is to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage or even individual application functions, with the possible exception of limited user-specific application configuration settings.

[0067] Platform as a Service (PaaS): The capability offered to a consumer is to deploy consumer-created or acquired applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does control the deployed applications and, potentially, the application hosting environment configuration.

[0068] Infrastructure as a Service (IaaS): The ability provided to a consumer is to provision processing, storage, network, and other basic computing resources, and the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does control the operating systems, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0069] The deployment model is as follows:

[0070] Private Cloud: Cloud infrastructure is operated solely for one organization. A private cloud may be managed by that organization or a third party and may exist on-premise or off-premise.

[0071] Community Cloud: Cloud infrastructure is shared among several organizations to support a particular community with common concerns (e.g., mission, security requirements, policies, and regulatory compliance considerations). Community clouds may be managed by those organizations or by a third party and may exist on-premise or off-premise.

[0072] Public Cloud: The cloud infrastructure is made available to the general public or a large industry entity and is owned by an organization that sells cloud services.

[0073] Hybrid Cloud: A cloud infrastructure that combines two or more clouds (private, community, or public) where each cloud remains its own entity but is bound together by standardized or proprietary technologies that allow portability of data and applications (e.g., cloud bursting to load balance between clouds).

[0074] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0075] 6, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers can communicate, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof. The nodes 10 may communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described herein above (not shown). This allows the cloud computing environment 50 to provide infrastructure, platform, or software, or combinations thereof, as a service, without the cloud consumer having to maintain resources on the local computing device. It will be understood that the types of computing devices 54A-54N shown in FIG. 6 are intended to be illustrative only, and that the computing node 10 and cloud computing environment 50 may communicate with any type of computerized device (e.g., using a web browser) through any type of network or network-addressable connection, or combination thereof.

[0076]

[0046] Referring now to Figure 7, there is shown a set of functional abstraction layers provided by cloud computing environment 50 (Figure 6). It should be understood in advance that the components, layers, and functions shown in Figure 7 are intended to be merely illustrative, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0077] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, RISC (reduced instruction set computing) architecture based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0078] The virtualization layer 70 provides an abstraction layer within which examples of virtual entities may be provided: virtual servers 71 , virtual storage 72 , virtual networks including virtual private networks 73 , virtual applications and operating systems 74 , and virtual clients 75 .

[0079] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection for data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources such that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides advance provisioning and procurement of cloud computing resources where future requirements are anticipated according to SLAs.

[0080] The workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and cryptography programs 175.

[0081] The present invention may be a system, method, or computer program product, or combination thereof, integrated at any possible level of technical detail. The present invention may be beneficially practiced in any system that processes instruction streams (single or in parallel). The computer program product may include a computer readable storage medium (or multiple computer readable storage media) having computer readable program instructions for causing a processor to perform aspects of the present invention.

[0082] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, punch cards or mechanically encoded devices such as ridge structures in grooves with instructions recorded therein, and any suitable combination of the above. As used herein, computer-readable storage media should not be interpreted as being a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0083] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium into each computing / processing device, or may be downloaded to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0084] The computer readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, source code or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server, as a stand-alone software package. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer readable program instructions to personalize the electronic circuitry by utilizing state information of the computer readable program instructions to perform aspects of the invention.

[0085] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations or block diagrams or combinations thereof, and combinations of blocks in the flowchart illustrations or block diagrams or combinations thereof, can be implemented by computer readable program instructions.

[0086] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine whereby the instructions, executed via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer readable storage medium having stored thereon instructions comprises an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0087] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device and cause the computer, other programmable apparatus, or other device to execute a series of operational steps to create a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0088] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions that includes one or more executable instructions that implement a specified logical function. In some alternative implementations, the functions noted in the blocks may be performed in a different order than that noted in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in the reverse order depending on the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of the blocks of the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware instructions and computer instructions.

[0089] References herein to "one embodiment," "an embodiment," "exemplary embodiment," and the like indicate that the embodiment being described may include a particular feature, structure, or characteristic, but not all embodiments may necessarily include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in connection with one embodiment, it is believed to be within the knowledge of one of ordinary skill in the art to affect such feature, structure, or characteristic in connection with other embodiments, whether or not explicitly described.

[0090] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It is to be further understood that the terms "comprises" and / or "comprising," as used herein, specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0091] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations that do not depart from the scope of the present invention will be apparent to those skilled in the art. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein. According to this specification, the following items are also disclosed. [Item 1] 1. A computer-implemented method for generating a unique key for a data set, comprising: assigning, by one or more computer processors, a data set associated with a security policy, the security policy specifying a key encryption key (KEK) label; deriving, by the one or more computer processors, the KEK label from the security policy; storing, by the one or more computer processors, the KEK label as metadata for the data set; opening, by the one or more computer processors, the dataset for an initial write; generating, by said one or more computer processors, a data encryption key (DEK); obtaining, by the one or more computer processors, a KEK from a key store according to the KEK label; encrypting, by the one or more computer processors, the DEK using the KEK; storing, by the one or more computer processors, the encrypted DEK as metadata for the data set; encrypting, by the one or more computer processors, the data set using the DEK; A computer-implemented method comprising: [Item 2] opening, by the one or more computer processors, the encrypted data set; obtaining, by the one or more computer processors, the KEK from the key store according to the KEK label of the encrypted data set; obtaining, by the one or more computer processors, the encrypted DEK from metadata of the encrypted data set; decrypting, by the one or more computer processors, the encrypted DEK using the KEK; decrypting, by the one or more computer processors, the encrypted data set using the DEK; providing, by said one or more computer processors, a user access to data of said dataset; The computer-implemented method of claim 1 , further comprising: [Item 3] assigning, by the one or more computer processors, a target data set associated with the security policy; deriving, by the one or more computer processors, the KEK label from the security policy; storing, by the one or more computer processors, the KEK label as metadata for the target data set; opening, by the one or more computer processors, the target data set for an initial write; generating, by the one or more computer processors, a DEK for a target data set; retrieving, by the one or more computer processors, the KEK from the key store according to the KEK label; encrypting, by the one or more computer processors, a DEK for the target data set using the KEK; storing, by the one or more computer processors, the encrypted DEK as metadata for the target data set; encrypting, by the one or more computer processors, a source data set as the target data set using a DEK of the target data set; 3. The computer-implemented method of claim 1 or 2, further comprising: [Item 4] The computer-implemented method of claim 3 , further comprising deleting the source data set. [Item 5] The computer-implemented method of claim 1 , further comprising: verifying a user's access to the assigned data set. [Item 6] The computer-implemented method of claim 1 , further comprising verifying user access to the KEK label. [Item 7] opening, by said one or more computer processors, the encrypted source data set; obtaining, by the one or more computer processors, the KEK associated with the KEK label from the key store according to the KEK label; obtaining, by the one or more computer processors, the encrypted DEK from metadata of a dataset; decrypting, by the one or more computer processors, the encrypted DEK using the KEK; decrypting, by the one or more computer processors, the encrypted source data set using the DEK; assigning, by the one or more computer processors, a target data set associated with the security policy; deriving, by the one or more computer processors, the KEK label from the security policy; storing, by the one or more computer processors, the KEK label as metadata for the target data set; opening, by the one or more computer processors, the target data set for an initial write; generating, by the one or more computer processors, a DEK for a target data set; obtaining, by the one or more computer processors, a KEK from the key store according to the KEK label; encrypting, by the one or more computer processors, a DEK for the target data set using the KEK; storing, by the one or more computer processors, the encrypted DEK as metadata of a target data set; encrypting, by the one or more computer processors, data of the source data set as the target data set using a DEK of the target data set; The computer-implemented method of claim 1 , further comprising: [Item 8] 1. A computer program for generating a unique key for a data set, the computer program comprising program instructions that, when executed by a computer, cause the computer to: program instructions for causing a data set to be assigned that is associated with a security policy, the security policy specifying a key encryption key (KEK) label; program instructions for deriving the KEK label from the security policy; program instructions to store the KEK label as metadata for the data set; program instructions that cause the data set to be opened for an initial write; program instructions for generating a data encryption key (DEK); program instructions for retrieving a KEK from a keystore according to said KEK label; program instructions for encrypting the DEK using the KEK; program instructions that cause the encrypted DEK to be stored as metadata for the data set; and program instructions for encrypting the data set using the DEK. Computer program. [Item 9] The program instructions, when executed by the computer, cause the computer to: program instructions for opening the encrypted data set; program instructions to retrieve the KEK from the keystore according to the KEK label of the encrypted data set; program instructions for deriving the encrypted DEK from metadata of the encrypted data set; program instructions for decrypting the encrypted DEK using the KEK; program instructions for decrypting the encrypted data set using the DEK; program instructions for providing a user access to data in said data set; 9. The computer program of claim 8, further comprising: [Item 10] The program instructions, when executed by the computer, cause the computer to program instructions for causing a target data set associated with said security policy to be assigned; program instructions for deriving the KEK label from the security policy; program instructions to store the KEK label as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions to retrieve the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK for the target data set using the KEK; program instructions that cause the encrypted DEK to be stored as metadata for the target data set; program instructions for encrypting a source data set as the target data set using the DEK of the target data set; 10. A computer program according to claim 8 or 9, further comprising: [Item 11] 11. The computer program of claim 10, further comprising program instructions which, when executed by the computer, cause the computer to delete the source data set. [Item 12] 12. A computer program as claimed in any one of claims 8 to 11, further comprising program instructions which, when executed by the computer, cause the computer to verify user access to the allocated data set. [Item 13] 13. The computer program of claim 8, further comprising program instructions which, when executed by the computer, cause the computer to verify user access to the KEK label. [Item 14] The program instructions, when executed by the computer, cause the computer to: program instructions for causing the encrypted source data set to be opened; program instructions for retrieving the KEK associated with the KEK label from the keystore in accordance with the KEK label; program instructions for deriving the DEK from metadata of an encrypted source data set; program instructions for causing the DEK to be decrypted using the KEK; program instructions for decrypting the encrypted source data set using the DEK; program instructions for causing a target data set associated with said security policy to be assigned; program instructions for deriving the KEK label from the security policy; program instructions to store the KEK label as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions to retrieve the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK for the target data set using the KEK; program instructions that cause the encrypted DEK to be stored as metadata for the target data set; program instructions for encrypting data of the source data set as the target data set using the DEK of the target data set; 14. A computer program according to any one of claims 8 to 13, further comprising: [Item 15] 1. A computer system for generating a unique key for a data set, the computer system comprising: one or more computer processors; one or more computer readable storage devices; and stored program instructions on one or more computer readable storage devices for execution by the one or more computer processors, the stored program instructions comprising: program instructions for allocating a data set associated with a security policy, the security policy specifying a key encryption key (KEK) label; program instructions for deriving the KEK label from the security policy; program instructions for storing the KEK label as metadata for the data set; program instructions for opening the data set for an initial write; program instructions for generating a data encryption key (DEK); program instructions for retrieving a KEK from a keystore according to said KEK label; program instructions for encrypting the DEK using the KEK; program instructions for storing the encrypted DEK as metadata for the data set; and program instructions for encrypting the data set using the DEK. Computer system. [Item 16] The stored program instructions include: program instructions for opening said encrypted data set; program instructions for retrieving the KEK from the keystore according to the KEK label of the encrypted data set; program instructions for deriving the encrypted DEK from metadata of the encrypted data set; program instructions for decrypting the encrypted DEK using the KEK; program instructions for decrypting the encrypted data set using the DEK; and program instructions for providing user access to data in said data set. 16. The computer system of claim 15, further comprising: [Item 17] The stored program instructions program instructions for assigning a target data set associated with said security policy; program instructions for deriving the KEK label from the security policy; program instructions for storing the KEK label as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions for retrieving the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK for the target data set using the KEK; program instructions for storing the encrypted DEK as metadata for the target data set; program instructions for encrypting a source data set as the target data set using the DEK of the target data set; 17. The computer system of claim 15 or 16, further comprising: [Item 18] 18. A computer system according to any one of claims 15 to 17, wherein the stored program instructions further comprise program instructions for validating user access to the assigned data set. [Item 19] 19. The computer system of claim 15, wherein the stored program instructions further comprise program instructions for validating user access to a KEK label. [Item 20] The program instructions include: program instructions for opening the encrypted source data set; program instructions for retrieving the KEK associated with the KEK label from the keystore according to the KEK label; program instructions for deriving the encrypted DEK from metadata of an encrypted source data set; program instructions for decrypting the encrypted DEK using the KEK; program instructions for decrypting the encrypted source data set using the DEK; program instructions for assigning a target data set associated with said security policy; program instructions for deriving the KEK label from the security policy; program instructions for storing the KEK label as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions for retrieving the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK of the target data set using the KEK; program instructions for storing the encrypted DEK as metadata for the target data set; program instructions for encrypting data of the source data set as the target data set using the DEK of the target data set; 20. The computer system of claim 15, further comprising:

Claims

1. 1. A computer-implemented method for generating a unique key for a data set, comprising: assigning, by one or more computer processors, a data set associated with a security policy, the security policy specifying a key encryption key (KEK) label; obtaining, by the one or more computer processors, the KEK label from the security policy; storing, by the one or more computer processors, the KEK label as metadata for the data set; opening, by the one or more computer processors, the dataset for an initial write; generating, by the one or more computer processors, a data encryption key (DEK); obtaining, by the one or more computer processors, a KEK from a key store according to the KEK label; encrypting, by the one or more computer processors, the DEK using the KEK; storing, by the one or more computer processors, the encrypted DEK as metadata for the data set; encrypting, by the one or more computer processors, the data set using the DEK; A computer-implemented method comprising:

2. opening, by the one or more computer processors, the encrypted data set; retrieving, by the one or more computer processors, the KEK from the key store according to the KEK label of the encrypted data set; obtaining, by the one or more computer processors, the encrypted DEK from metadata of the encrypted data set; decrypting, by the one or more computer processors, the encrypted DEK using the KEK; decrypting, by the one or more computer processors, the encrypted data set using the DEK; providing, by said one or more computer processors, a user access to data of said dataset; The computer-implemented method of claim 1 , further comprising:

3. assigning, by the one or more computer processors, a target data set associated with the security policy; obtaining, by the one or more computer processors, the KEK label from the security policy; storing, by the one or more computer processors, the KEK label as metadata for the target data set; opening, by the one or more computer processors, the target data set for an initial write; generating, by the one or more computer processors, a DEK for a target data set; retrieving, by the one or more computer processors, the KEK from the key store according to the KEK label; encrypting, by the one or more computer processors, a DEK for the target data set using the KEK; storing, by the one or more computer processors, the encrypted DEK as metadata for the target data set; encrypting, by the one or more computer processors, a source data set as the target data set using a DEK of the target data set; The computer-implemented method of claim 1 or 2, further comprising:

4. The computer-implemented method of claim 3 , further comprising deleting the source data set.

5. The computer-implemented method of claim 1 , further comprising verifying a user's access to the assigned data set.

6. The computer-implemented method of claim 1 , further comprising verifying user access to the KEK label.

7. opening, by the one or more computer processors, the encrypted source data set; obtaining, by the one or more computer processors, the KEK associated with the KEK label from the key store according to the KEK label; obtaining, by the one or more computer processors, the encrypted DEK from metadata of an encrypted source data set; decrypting, by the one or more computer processors, the encrypted DEK using the KEK; decrypting, by the one or more computer processors, the encrypted source data set using the DEK; assigning, by the one or more computer processors, a target data set associated with the security policy; obtaining, by the one or more computer processors, the KEK label from the security policy; storing, by the one or more computer processors, the KEK label as metadata for the target data set; opening, by the one or more computer processors, the target data set for an initial write; generating, by the one or more computer processors, a DEK for a target data set; obtaining, by the one or more computer processors, a KEK from the key store according to the KEK label; encrypting, by the one or more computer processors, a DEK for the target data set using the KEK; storing, by the one or more computer processors, the encrypted DEK as metadata of a target data set; encrypting, by the one or more computer processors, data of the source data set as the target data set using a DEK of the target data set; The computer-implemented method of claim 1 , further comprising:

8. 1. A computer program for generating a unique key for a data set, the computer program comprising program instructions that, when executed by a computer, cause the computer to: program instructions for causing a data set to be assigned that is associated with a security policy, the security policy specifying a key encryption key (KEK) label; program instructions for deriving the KEK label from the security policy; program instructions to cause the KEK label to be stored as metadata for the data set; program instructions that cause the data set to be opened for an initial write; program instructions for generating a data encryption key (DEK); program instructions for retrieving a KEK from a keystore according to said KEK label; program instructions for encrypting the DEK using the KEK; program instructions that cause the encrypted DEK to be stored as metadata for the data set; and program instructions for encrypting the data set using the DEK. Computer program.

9. The program instructions, when executed by the computer, cause the computer to: program instructions for opening the encrypted data set; program instructions for retrieving the KEK from the key store according to the KEK label of the encrypted data set; program instructions for deriving the encrypted DEK from metadata of the encrypted data set; program instructions for decrypting the encrypted DEK using the KEK; program instructions for decrypting the encrypted data set using the DEK; program instructions for providing a user access to data in said data set; The computer program product of claim 8 , further comprising:

10. The program instructions, when executed by the computer, cause the computer to program instructions for causing a target data set associated with said security policy to be assigned; program instructions for deriving the KEK label from the security policy; program instructions to cause the KEK label to be stored as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions for retrieving the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK for the target data set using the KEK; program instructions that cause the encrypted DEK to be stored as metadata for the target data set; program instructions for encrypting a source data set as the target data set using the DEK of the target data set; 10. A computer program according to claim 8 or 9, further comprising:

11. 11. The computer program of claim 10, further comprising program instructions which, when executed by the computer, cause the computer to delete the source data set.

12. 12. A computer program as claimed in any one of claims 8 to 11, further comprising program instructions which, when executed by the computer, cause the computer to verify user access to the allocated data set.

13. 13. A computer program product as claimed in any one of claims 8 to 12, further comprising program instructions which, when executed by the computer, cause the computer to validate user access to the KEK label.

14. The program instructions, when executed by the computer, cause the computer to: program instructions for causing the encrypted source data set to be opened; program instructions for retrieving the KEK associated with the KEK label from the keystore according to the KEK label; program instructions for deriving the DEK from metadata of an encrypted source data set; program instructions for causing the DEK to be decrypted using the KEK; program instructions for decrypting the encrypted source data set using the DEK; program instructions for causing a target data set associated with said security policy to be assigned; program instructions for deriving the KEK label from the security policy; program instructions to cause the KEK label to be stored as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions for retrieving the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK for the target data set using the KEK; program instructions that cause the encrypted DEK to be stored as metadata for the target data set; program instructions for encrypting data of the source data set as the target data set using the DEK of the target data set; 14. A computer program according to any one of claims 8 to 13, further comprising:

15. 1. A computer system for generating a unique key for a data set, the computer system comprising: one or more computer processors; one or more computer readable storage devices; and stored program instructions on one or more computer readable storage devices for execution by the one or more computer processors, the stored program instructions comprising: program instructions for allocating a data set associated with a security policy, the security policy specifying a key encryption key (KEK) label; program instructions for deriving the KEK label from the security policy; program instructions for storing the KEK label as metadata for the data set; program instructions for opening the data set for an initial write; program instructions for generating a data encryption key (DEK); program instructions for obtaining a KEK from a keystore according to the KEK label; program instructions for encrypting the DEK using the KEK; program instructions for storing the encrypted DEK as metadata for the data set; and program instructions for encrypting the data set using the DEK. Computer system.

16. The stored program instructions include: program instructions for opening said encrypted data set; program instructions for retrieving the KEK from the key store according to the KEK label of the encrypted data set; program instructions for deriving the encrypted DEK from metadata of the encrypted data set; program instructions for decrypting the encrypted DEK using the KEK; program instructions for decrypting the encrypted data set using the DEK; and program instructions for providing user access to data in said data set.

16. The computer system of claim 15, further comprising:

17. The stored program instructions program instructions for assigning a target data set associated with said security policy; program instructions for deriving the KEK label from the security policy; program instructions for storing the KEK label as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions for obtaining the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK for the target data set using the KEK; program instructions for storing the encrypted DEK as metadata of the target data set; program instructions for encrypting a source data set as the target data set using the DEK of the target data set; 17. The computer system of claim 15 or 16, further comprising:

18. 18. A computer system according to any one of claims 15 to 17, wherein the stored program instructions further comprise program instructions for validating user access to the assigned data set.

19. 19. A computer system according to any one of claims 15 to 18, wherein the stored program instructions further comprise program instructions for validating user access to a KEK label.

20. The program instructions include: program instructions for opening the encrypted source data set; program instructions for obtaining the KEK associated with the KEK label from the keystore according to the KEK label; program instructions for deriving the encrypted DEK from metadata of an encrypted source data set; program instructions for decrypting the encrypted DEK using the KEK; program instructions for decrypting the encrypted source data set using the DEK; program instructions for assigning a target data set associated with said security policy; program instructions for deriving the KEK label from the security policy; program instructions for storing the KEK label as metadata for the target data set; program instructions for opening the target data set for an initial write; program instructions for generating a DEK for a target data set; program instructions for obtaining the KEK from the keystore according to the KEK label; program instructions for encrypting a DEK of the target data set using the KEK; program instructions for storing the encrypted DEK as metadata of the target data set; program instructions for encrypting data of the source data set as the target data set using the DEK of the target data set; 20. The computer system of claim 15, further comprising:

Images