Patent ID: 8856530
Filing Date: 2014-10-07
Classification: H04L

Abstract:
1. A system for storing a plurality of encrypted data objects and providing access to a group of users comprising: a record of user accounts, wherein at least one record for a user account includes: a user identifier, and a public encryption key corresponding to a private encryption key, the private encryption key known to the user and unknown to the server; at least one access control list (ACL) defining an access control policy for a group of users, wherein the ACL includes: permissions for the group of users, wherein each user of the group has access to a plurality of data objects associated with the ACL as defined by the permissions, and an ACL key list including, for each authorized user of the group, a copy of a symmetric ACL key corresponding to the ACL (ACL key) encrypted with the public encryption key of the user; a user-data non-transitory machine readable storage medium including: encrypted user data, stored as a plurality of data objects associated with the ACL, each object encrypted with the ACL key, and cleartext meta-data that describes each data object including an identifier of the ACL associated with the data object; and an access controller configured to: receive, from a user, an access request from a user requesting access to a requested data object, and send, to the user, a copy of the requested encrypted data object to the user if the ACL associated with the data object indicates that the user has permission to access the data object; and send, to a user, the copy of the ACL key encrypted with the public key of the user, wherein an authentication controller configured to: receive data objects sent to the system by a user that have been digitally signed with the private encryption key of the user; and authenticate the data object by applying the user public key, wherein the authentication controller is further configured to: generate an accounting record including at least the identifier of the user and a time of receipt; and store the accounting record as meta-data associated with the data object.