Patent ID: 8914632

Claim:
A method, comprising: receiving, by a management server of a hosted storage service, a data resource and a resource authentication credential; assigning, by the hosted storage service, an encryption key to the data resource; encrypting the data resource to form an encrypted data resource; storing the encrypted data resource in a storage facility of the hosted storage service; producing, based on the assigned encryption key, a wrapped encryption key; storing the wrapped encryption key in an access control list (ACL) in association with the encrypted data resource; receiving, from a first user, a request to access the data resource, wherein the request includes a presented authentication credential and a request to share the data resource with a second user; in response to receiving the request, automatically and without additional input from the user, verifying that the presented authentication credential demonstrates authorization to unwrap the wrapped encryption key, and unwrapping the wrapped encryption key; using the unwrapped encryption key to decrypt the encrypted data resource; providing the first user with access to the data resource; determining that the first user is authorized to share the data resource; and re-wrapping the unwrapped encryption key for the second user.