Patent ID: 8731201

Claim:
A system, comprising: a server machine configured with a content delivery and management service implemented in a non-transitory computer-readable storage medium and to process on the server machine; and a client machine configured with a client service implemented in non-transitory computer-readable storage and to process on the client machine; the content delivery and management service and client service configured to communicate over a network via secure and insecure communication sessions, and the client service is configured to supply encrypted content that the content delivery and management service houses and distributes via the insecure communication sessions, and the client service is configured to supply an encrypted version of a content encryption/decryption key that is encrypted by the client service with a first key, and the client service is also configured to supply an encrypted version of the first key to the content delivery and management service, wherein the content delivery and management service is configured to receive and distribute the encrypted versions of the content encryption/decryption key and the encrypted version of the first key via the secure communication sessions, decrypted versions of both the content encryption/decryption key and the first key are hidden and unknown to the content delivery and manager service and the content delivery and management service distributes the encrypted versions of both the content encryption/decryption key and the first key to a principal designated by a policy, the first key is known to just the principal and produced by the principal via the client service and escrowed by the principal with the content and management service as the encrypted version of the first key.