Patent ID: 8607358

Claim:
A method performed by one or more processors, the method comprising: receiving, from an application server system and at a key server system, a seed value; generating, at the key server system, a resource encryption key from the seed value; sending, from the key server system to the application server system, the resource encryption key such that the application server system is able to encrypt a resource using the resource encryption key; receiving, from the application server system and at the key server system, authentication credentials and a wrapped key, the wrapped key including a resource identifier, a resource encryption key, and a user identifier that have been encrypted using a master key, wherein the resource identifier identifies the resource encrypted with the resource encryption key and the user identifier identifies a user that is permitted to use the resource encryption key to decrypt the resource; decrypting the wrapped key to generate an unwrapped key that includes the resource identifier, the resource encryption key, and the user identifier in unencrypted form; accessing the user identifier from the unwrapped key; determining that the received authentication credentials correspond to the accessed user identifier; and in response to determining that the received authentication credentials correspond to the accessed user identifier, sending the resource encryption key in unecrypted form to the application server system such that the application server system can decrypt the resource using the resource encryption key in unencrypted form.