1. A method of performing an operation on a data storage for storing data being encrypted with a key K D associated with an owner of the data, the method comprising: for each client C j of one or more clients which are authorized to perform operations on the data storage: deriving a first key K Cj and a second key K Tj such that the key K D can be derived from the first key K Cj and the second key K Tj , providing the client C j with the first key K Cj , and providing a Trusted Third Party, TTP, with the second key K Tj , and at a Policy Enforcement Point, PEP: receiving a request for performing the operation on the data storage from a client C k of the one or more clients, acquiring a first key K Ck from the client C k , acquiring a second key K Tk from the TTP, deriving the key K D from the first key K Ck and the second key K Tk , and performing the operation on the data storage using the derived key K D .