A computing system comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to perform a method for encrypting and sharing one or more data objects stored in a personal storage that is associated with a first DID (205, 331, 721, 1050, 1130), the method comprising: generating an encryption/decryption key (509, 726, 912, 1015, 1121) using a passphrase (601, 723, 1012) and an identifier (502, 602, 724, 1013) of the personal storage that stores or is to store a data object (506, 911); encrypting the data object (506, 911) stored or to be stored in the personal storage using the encryption/decryption key (509, 726, 912, 1015, 1121); storing the encrypted data object (510, 913) in the personal storage; receiving a request for accessing the encrypted data object (510, 913) from another entity (820, 920, 930, 1020, 1030, 1120) that is not associated with the DID (205, 331, 721, 1050, 1130); negotiating with the other entity (820, 920, 930, 1020, 1030, 1120) a protection strategy for protecting the encryption/decryption key (509, 726, 912, 1015, 1121); protecting the encryption/decryption key (509, 726, 912, 1015, 1121) based on the negotiated protection strategy; and sending the encrypted data object and the protected encryption/decryption key (509, 726, 912, 1015, 1121) to the other entity. one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to perform a method for encrypting and sharing one or more data objects stored in a personal storage that is associated with a first DID (205, 331, 721, 1050, 1130), the method comprising: generating an encryption/decryption key (509, 726, 912, 1015, 1121) using a passphrase (601, 723, 1012) and an identifier (502, 602, 724, 1013) of the personal storage that stores or is to store a data object (506, 911); encrypting the data object (506, 911) stored or to be stored in the personal storage using the encryption/decryption key (509, 726, 912, 1015, 1121); storing the encrypted data object (510, 913) in the personal storage; receiving a request for accessing the encrypted data object (510, 913) from another entity (820, 920, 930, 1020, 1030, 1120) that is not associated with the DID (205, 331, 721, 1050, 1130); negotiating with the other entity (820, 920, 930, 1020, 1030, 1120) a protection strategy for protecting the encryption/decryption key (509, 726, 912, 1015, 1121); protecting the encryption/decryption key (509, 726, 912, 1015, 1121) based on the negotiated protection strategy; and sending the encrypted data object and the protected encryption/decryption key (509, 726, 912, 1015, 1121) to the other entity. generating an encryption/decryption key (509, 726, 912, 1015, 1121) using a passphrase (601, 723, 1012) and an identifier (502, 602, 724, 1013) of the personal storage that stores or is to store a data object (506, 911); encrypting the data object (506, 911) stored or to be stored in the personal storage using the encryption/decryption key (509, 726, 912, 1015, 1121); storing the encrypted data object (510, 913) in the personal storage; receiving a request for accessing the encrypted data object (510, 913) from another entity (820, 920, 930, 1020, 1030, 1120) that is not associated with the DID (205, 331, 721, 1050, 1130); negotiating with the other entity (820, 920, 930, 1020, 1030, 1120) a protection strategy for protecting the encryption/decryption key (509, 726, 912, 1015, 1121); protecting the encryption/decryption key (509, 726, 912, 1015, 1121) based on the negotiated protection strategy; and sending the encrypted data object and the protected encryption/decryption key (509, 726, 912, 1015, 1121) to the other entity.