Patent ID: 7864960
Filing Date: 2011-01-04
Classification: G06F

Abstract:
1. A method residing and implemented in a non-transitory machine-accessible medium and for executing on a processing device, comprising: receiving, by the processing device, an encrypted version of a content encryption/decryption key from a principal, wherein the content encryption/decryption key has been encrypted by the principal using a first key known to just the principal; receiving, by the processing device, an encrypted version of the first key; storing, by the processing device, the encrypted versions of the content encryption/decryption key and the first key in an environment that is remote from the principal over a network connection; housing, by the processing device, encrypted content that has already been encrypted by the principal with the content encryption/decryption key, wherein the principal supplies the encrypted content; delivering, by the processing device, the encrypted content via insecure communications and the encrypted versions of the content encryption/decryption key in response to policy via secure communications; receiving, by the processing device, a second encrypted version of the content encryption/decryption key from the principal, wherein the second encrypted version of the content encryption/decryption key and the encrypted content are identified as being accessible via policy to a second principal; storing, by the processing device, the second encrypted version of the content encryption/decryption key in the environment; delivering, by the processing device, the second encrypted version of the content encryption/decryption key to the second principal when the second principal authenticates and during a secure communication session for the second principal to use in order to acquire the content encryption/decryption key and decrypt the encrypted content; receiving, by the processing device, an instruction from the principal to revoke access rights to the encrypted content associated with the second principal; locking, by the processing device, access to the encrypted content to prevent the second principal from acquiring the encrypted content; receiving, by the processing device, an encrypted version of a second content encryption/decryption key from the principal, wherein the second content encryption/decryption key is also encrypted with the first key known to the principal; housing, by the processing device, a re-encrypted and new version of the encrypted content that is now encrypted with the second content encryption/decryption key; and unlocking, by the processing device, access to the re-encrypted and new version of the encrypted content.