Patent ID: 9639705
Date: 2017-05-02
CPC Classifications: G06F,H04L

Claim:
1. A system, comprising: a data management component configured to be installed on a client device associated with a customer, the data management component configured to receive an indication of customer data for storage in a remote data service of a resource provider, the data management component configured to obtain access to an object key for encrypting the customer data; a key management system configured to maintain a master key for wrapping the object key, the master key unexportable outside the key management system; a data store provided as part of the remote data service, the customer having an account with the resource provider for storing the customer data to the data store; a data ingestion station configured to receive the customer data and identifying information for the object key, the data ingestion station further configured to cause the customer data, encrypted under the object key, and the identifying information to be stored to the data store and associated with a customer identifier; an interface for receiving a request, associated with the customer identifier, for a portion of the customer data; and a data interface component, provided as part of the data storage service by the resource provider, configured to obtain access to the object key using the identifying information and the object key wrapped with the master key, the data interface component further configured to decrypt the portion of the customer data using the object key and transmit the portion of the decrypted customer data to an address specified by the request.