Patent ID: 8256007

Claim:
A system for managing security rights of protected data, the system having a plurality of security groups, the system comprising: a client configured to generate the protected data, wherein a user of the client is a member of a subset of the plurality of security groups, the client comprising: a key generator configured to generate a plurality of security group keys, wherein each security group key is associated with a security group selected by the user of the client, and wherein each security group key comprises an encryption key; a combination key generator configured to generate a combination key based on the plurality of security group keys, wherein the client is configured to encrypt the protected data with the combination key; and an issuance license generator that generates an issuance license that includes the plurality of security group keys; a security applet configured to: replace the protected data with group encrypted data, wherein the group encrypted data comprises the issuance license with the encrypted security group keys and the protected data encrypted with the combination key; generate a security role issuance license that includes (i) a first security role key associated with a first set of privileges to the protected data, the first set of privileges being for a first security role define by digital rights management (DRM) functionality and (ii) a second security role key associated with a second set of privileges to the protected data, the second set of privileges being for a second security role defined by DRM functionality; and doubly encrypt at least a portion the group encrypted data based on the first security role key and the second security role key to form doubly encrypted data; and a server configured with DRM functionality, wherein the server is configured to: authenticate the client; encrypt the security group keys in the issuance license with a first security key and return the issuance license with the encrypted security group keys to the client; and encrypt the security role keys with a second security key, different than the first security key wherein the doubly encrypted data is decryptable by an entity possessing: an end-user role license comprising one or more keys employable to reveal a portion of the group encrypted data; and an end-user security group license comprising each of the plurality of security group keys.