Patent ID: 8635464

Claim:
An attribute-based access-controlled data-storage system comprising: a data-store system that stores data objects, in one or more electronic data-storage components and/or electronic data-storage subsystems, that each comprises an encrypted data payload and a descriptor that includes, references, or is computationally associated with a hybrid-attribute-associated/hierarchical-key-derivation-encrypted data-payload access key stored in the one or more electronic data-storage components and/or electronic data-storage subsystems; and an owner system on behalf of which the data-store system creates and stores the data objects, the owner system creating access policies for the data objects owned by the owner system, each access policy controlling hybrid-attribute-associated/hierarchical-key-derivation encryption of a data-payload access key for inclusion of the encrypted data-payload access key in a data object associated with the access policy, reference to the encrypted data-payload access key from the data object associated with the access policy, or association of the encrypted data-payload access key with the data object associated with the access policy, and storing the access policies stored in one or more electronic data-storage components and/or electronic data-storage subsystems, within the owner system and the data-store system, wherein attribute-based/hierarchical-key-derivation encryption encrypts a data-payload access key using an attribute-associated encryption method, producing an attribute-associated-encrypted data-payload access key, and encrypts a hierarchical-key-derivation encryption key using the attribute-associated encryption method, producing an attribute-associated-encrypted hierarchical-key-derivation encryption key, and combines the attribute-associated-encrypted data-payload access key and attribute-associated-encrypted hierarchical-key-derivation encryption key together to produce a multi-part cryptogram, and wherein the multi-part cryptogram additionally contains the data-payload access key encrypted by a second encryption method that uses the hierarchical-key-derivation encryption key as an encryption key.