Patent ID: 7792301

Claim:
A computer-implemented method comprising: storing, in a memory, instructions for performing the method; executing the instructions on a processor; according to the instructions being executed: obtaining an access control policy (ACP) that is associated with an encrypted information unit, wherein the encrypted information unit comprises data and metadata; wherein the encrypted information unit is stored in a storage system, wherein the storage system comprises a hierarchically linked chain of nodes; wherein each node stores a respective encrypted information unit; wherein each chain of nodes includes a zone root node, and a zone root key associated therewith; and wherein the metadata comprises an information unit encryption key (IUEK) as encrypted by an information unit encryption key (IUEK) stored in a parent encrypted information unit which occupies the most proximate previous linked node in a storage system; contacting a trusted storage with reference to the ACP that is associated with the encrypted information unit; receiving from the trusted storage a zone root key that corresponds to the ACP that is associated with the encrypted information unit; and using the zone root key, traversing an encryption key chain to decrypt an information unit encryption key that corresponds to the encrypted information unit, wherein traversing comprises: decrypting an information unit encryption key associated with the zone root node using the zone root key; decrypting one or more respective intermediate information unit encryption keys using respective information unit encryption keys stored in a respective most-proximate previous linked node in a storage system; wherein the encryption key chain comprises the information unit encryption keys, each one of the information unit encryption keys associated with a node in a chain of nodes which includes the encrypted information unit; and wherein the decrypting of the one or more respective intermediate information unit encryption keys comprises decrypting the information unit encryption key that corresponds to the encrypted information unit using the encryption key associated with the respective most-proximate previous linked node associated with the encrypted information unit.