Cloud key directory for federating data exchanges

A computer system, comprising:

• one or more processors;
• and
• one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computer system to secure data using attribute-based encryption, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:
• encrypt a portion of data using multi-authority attribute-based encryption, the portion of data having a data owner;
• associate the encrypted portion of data with one or more encryption attributes;
• store the encrypted portion of data and the one or more encryption attributes in a data store;
• and
• define one or more access controls for the portion of data that include an identity of a plurality of users permitted to access some or all of the portion of data, wherein the plurality of users permitted to access some or all of the portion of data are distinct from the data owner, wherein the attribute-based encryption allows some or all of the encrypted portion of data to be provided by the data store upon receiving a request that includes a confirmed identity of at least one of the plurality of users permitted to access the portion of data and at least a threshold number of the one or more encryption attributes, a particular sub-portion of the portion of data being provided to the at least one user being determined by the confirmed identity of the at least one user and the at least a threshold number of encryption attributes provided in the request.

A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors to cause a computer system to secure data using attribute-based encryption, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:

• encrypt a portion of data using multi-authority attribute-based encryption, the portion of data having a data owner;
• associate the encrypted portion of data with one or more encryption attributes;
• store the encrypted portion of data and the one or more encryption attributes in a data store;
• and
• define one or more access controls for the portion of data that include an identity of a plurality of users permitted to access some or all of the portion of data, wherein the plurality of users permitted to access some or all of the portion of data are distinct from the data owner, wherein the attribute-based encryption allows some or all of the encrypted portion of data to be provided by the data store upon receiving a request that includes a confirmed identity of at least one of the plurality of users permitted to access the portion of data and at least a threshold number of the one or more encryption attributes, a particular sub-portion of the portion of data being provided to the at least one user being determined by the confirmed identity of the at least one user and the at least a threshold number of encryption attributes provided in the request.