Patent ID: 11930109
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 19:
20. A system, comprising:
a client side system, the client side system comprising:
a first processor; and
logic integrated with the first processor, executable by the first processor, or integrated with and executable by the first processor, the logic being configured to:
encrypt, by the first processor, data using an encryption key, wherein the encryption key is associated with a set of key identifiers usable to restrict access to a subset of privileges for decrypting the data using the encryption key, wherein a first key identifier of the set of key identifiers expires in response to passage of a predetermined period of time and all future data access requests using the first key identifier after expiration of said first key identifier are denied;
provide, by the first processor, a storage system with the set of key identifiers, wherein each key identifier is associated with information specifying a storage location the key identifier is authorized for;
send, by the first processor, at least one key identifier of the set of key identifiers to the storage system with a data access request, wherein the storage system is configured to determine whether the data access request is authorized for the at least one key identifier; and

the storage system, the storage system comprising:
a second processor; and
logic integrated with the second processor, executable by the second processor, or integrated with and executable by the second processor, the logic being configured to:
receive, by the second processor, the encrypted data and the set of key identifiers;
store, by the second processor, the encrypted data in at least one storage location;
receive, by the second processor, one of the key identifiers of the set of key identifiers with the data access request;
determine, by the second processor, whether the data access request is authorized for the received key identifier;
in response to determining that the data access request is authorized for the received key identifier, fulfilling the data access request using the encryption key;
receiving, by the second processor, a second of the key identifiers of the set of key identifiers with a second data access request;
determining, by the second processor, whether the second data access request is authorized for the received second key identifier; and
in response to determining that the second data access request is authorized for the received second key identifier, fulfilling the second data access request using the encryption key.