Patent ID: 8892865

Claim:
A computer-implemented method for providing access to data, comprising: under control of one or more computer systems configured with executable instructions, receiving a root key from a first authority; deriving, by a second authority, a plurality of keys to form a key hierarchy that comprises the root key and a plurality of levels of subordinate keys, each subordinate key being derived by at least computation of a value of a cryptographic hash function applied to a first operand based at least in part on a parent key to the subordinate key and a second operand associated with a restriction on the subordinate key, wherein an individual level of the plurality of levels of subordinate keys corresponds to a particular combination of one or more restrictions applied by the first authority and the second authority, the one or more restrictions individually being based on at least one of date, time, virtual computer system service, or geographical region; storing, in a data storage system comprising one or more storage devices, data encrypted using a subordinate key from the key hierarchy; identifying a key in a key path connecting, in the key hierarchy, the subordinate key to the root key, the identified key being different from the subordinate key; computing, based at least in part on the identified key, the subordinate key; decrypting, using the computed subordinate key, the stored encrypted data; and providing access to the decrypted data.