A method for controlling access to streaming data by users over an untrusted network, comprising at a trusted network zone : a. at an encryption computer system obtaining from a key generator a first symmetric encryption key stream comprising a first plurality of distinct symmetric encryption keys encrypting respective sequential portions of a first data stream to create a first symmetrically encrypted data stream comprising sequential portions of encrypted data; b. receiving a plurality of public asymmetric encryption keys from respective remote computer systems over an untrusted network; further comprising; c. generating asymmetrically encrypted key stream data by digitally encrypting by the encryption computer system the first symmetric encryption key stream using each one of the plurality of public asymmetric encryption keys to create respective asymmetrically encrypted first key streams wherein each of the asymmetrically encrypted first key streams is encrypted with a respective one of the plurality of public asymmetric encryption keys, the asymmetrically encrypted key stream data comprising each of the asymmetrically encrypted first key streams, wherein at least one of the asymmetrically encrypted first key streams corresponds to a subset of only some of the first plurality of distinct symmetric encryption keys of the first symmetric encryption key stream, the subset of only some of the first plurality of distinct symmetric encryption keys corresponds to at least one selected portion of the first data stream to which data-access permission is granted to an entity associated with the public asymmetric encryption key used to create the at least one of the asymmetrically encrypted first key streams; and d. from the encryption computer system, transmitting the asymmetrically encrypted key stream data over the untrusted network. a. at an encryption computer system obtaining from a key generator a first symmetric encryption key stream comprising a first plurality of distinct symmetric encryption keys encrypting respective sequential portions of a first data stream to create a first symmetrically encrypted data stream comprising sequential portions of encrypted data; b. receiving a plurality of public asymmetric encryption keys from respective remote computer systems over an untrusted network; further comprising; c. generating asymmetrically encrypted key stream data by digitally encrypting by the encryption computer system the first symmetric encryption key stream using each one of the plurality of public asymmetric encryption keys to create respective asymmetrically encrypted first key streams wherein each of the asymmetrically encrypted first key streams is encrypted with a respective one of the plurality of public asymmetric encryption keys, the asymmetrically encrypted key stream data comprising each of the asymmetrically encrypted first key streams, wherein at least one of the asymmetrically encrypted first key streams corresponds to a subset of only some of the first plurality of distinct symmetric encryption keys of the first symmetric encryption key stream, the subset of only some of the first plurality of distinct symmetric encryption keys corresponds to at least one selected portion of the first data stream to which data-access permission is granted to an entity associated with the public asymmetric encryption key used to create the at least one of the asymmetrically encrypted first key streams; and d. from the encryption computer system, transmitting the asymmetrically encrypted key stream data over the untrusted network. <EOS>