Patent ID: 8621220

Claim:
A method comprising: generating a first request for a user key to access a service, the service provided by an enterprise and hosted within a public cloud; receiving the user key in response to the first request; transmitting a second request for a country key, the country key assigned to a country of a user for whom the user key is requested; receiving the country key in response to the second request; encrypting session data resulting from the use of the service hosted within the public cloud using the user key; encrypting, using one or more processors, the user key using the country key; transmitting the encrypted session data and the encrypted user key to the public cloud; generating a third request; the third request being for session data of a plurality of users of the country, including an indication of the country associated with the country key; receiving the country key in response to the third request; decrypting user keys stored in the public cloud, the user keys used to encrypt the session data of the plurality of users of the country, wherein other user keys stored in the public cloud encrypted using another country key remain encrypted; and decrypting the session data of the plurality of users of the country using the decrypted user keys.