Patent ID: 8738531

Claim:
A computer-implemented method for controlling access to protected objects in a distributed environment, the method comprising: on a local computer having a processor, a data storage and a memory, encrypting an object using a randomly generated object key K OBJ ; receiving, from a user, at the local computer, a public key K UP of the user; receiving, at the local computer, a server key K S from a remote server; on the local computer, protecting the object key K OBJ by converting the object key K OBJ to a combination key K C using a server key K S , by either XORing the object key K OBJ and the server key K S , or by encrypting the object key K OBJ using the server key K S ; generating, on the local computer, for each user who has access to the protected object, a metadata field Data i by encrypting the combination key K C , using the public key K UP ; storing the metadata field Data i on the storage device; providing, to the local computer, a user key K U corresponding to the public key K UP ; obtaining the combination key K C by decrypting, on the local computer, a metadata field Data i using the key K U , wherein the public key K UP is used to generate the metadata field Data i , and wherein the metadata field Data i is stored on the data storage together with a protected object's metadata; sending a request, from the local computer to a remote server, to permit to the user to access the protected object; receiving, at the local computer, a server key K S from the remote server; calculating, on the local computer, the object key K OBJ from the combination key K C and the server key K S by either XORing the combination key K C and the server key K S , or by decrypting the combination key K C using the server key K S ; and decrypting, in the memory of the local computer, the protected object using the calculated object key K OBJ , to thereby give the user access, on the local computer, to the protected object.