Patent ID: 8364984

Claim:
One or more computer storage media hardware having stored thereon multiple instructions that, when executed by one or more processors of a device, cause the one or more processors to: receive a request associated with a current user of the device to access a portable secure data file including an encrypted data portion and a metadata portion; access at least one service record of a plurality of service records in the metadata portion, each service record including information associated with locating a remote service associated with the service record, each service record being encrypted to the remote service with a public key associated with the remote service; access the remote service associated with the at least one service record; receive, from the remote service, an indication of whether the current user of the device can access the encrypted data portion, wherein the indication comprises an additional record including both a content encryption key to be used to decrypt the encrypted data portion and a policy encryption key to be used to decrypt an encrypted access control policy in the metadata portion, the additional record being encrypted with a public key of the current user of the device; and store the additional record in the metadata portion only if the access control policy indicates that the additional record can be stored in the metadata portion.