Patent ID: 8261320

Claim:
A computer-implemented method for securely managing access to data, the method comprising: identifying a request to access encrypted data, the request being made by an application running on an insecure platform; determining that a requestor has a right to access the encrypted data; decrypting the encrypted data to provide decrypted data; in response to identifying the request to access encrypted data and determining that the requestor has the right to access the encrypted data, permitting a secure platform to access the decrypted data, wherein: an authorization platform performs at least one of the steps of identifying, including, submitting, receiving, decrypting, and permitting; the insecure platform comprises an insecure virtual machine; the secure platform comprises a first secure virtual machine; the authorization platform comprises a second secure virtual machine; a hypervisor manages the insecure virtual machine, the first secure virtual machine, and the second secure virtual machine; the authorization platform comprises a proof-carrying authorization platform that facilitates authentication information being included with the request to access the encrypted data.