Patent ID: 7865742

Claim:
A computer controlled method for generating one or more capability keys related to an unencrypted data unit comprising: selecting one or more attributes from a list of attributes related to said unencrypted data unit; using a computer, computing a key descriptor responsive to a selection of one or more access rights capable of being represented by a monotone boolean relationship between said one or more attributes; generating one or more random numbers; generating one or more shares responsive to said monotone boolean relationship and responsive to a master secret; generating a unique capability key responsive to one or more cryptosystem parameters, said one or more shares and said one or more random numbers, wherein said unique capability key and said key descriptor together enable decryption of sensitive information within a selectively encrypted data unit created from the unencrypted data unit; and providing said unique capability key and said key descriptor wherein at least one of said one or more access rights is specified as a threshold relationship of said one or more attributes from a subset of said one or more attributes; wherein the generating said one or more shares further comprises selecting a random polynomial of degree Iâˆ’1 responsive to said master secret wherein said one or more shares can be represented as one or more respective points on said random polynomial; wherein the threshold relationship is operative to reduce the number of shares and number of auxiliary values; and wherein I is the number of attributes in the threshold relationship.