An approach where data is encrypted with a DEK and the DEK is then encrypted by a KEK for scalable key protection.