Techniques for cloud-based privacy controls

A computer-implemented method, comprising:

• determining, by one or more processors of a data producer device, content;
• determining, by the one or more processors, a content encryption key (CEK);
• determining, by the one or more processors and using the CEK, encrypted content;
• determining, by the one or more processors, one or more privacy domain public keys associated with corresponding one or more privacy domains;
• determining, by the one or more processors and based on the one or more privacy domain public keys, at least two end-to-end encryption keys (E2EK), wherein:
• a first E2EK is used by data consumers of a cloud privacy control (CPC);
• and
• a second E2EK used by other data consumers;
• encrypting, by the one or more processors and using the at least two E2EK, the CEK to produce two or more encrypted CEKs (ECEKs);
• determining, by the one or more processors, a cloud privacy control public key;
• encrypting, by the one or more processors and using the CPC public key, the two or more ECEKs to produce two or more double-encrypted CEKs (DECEKs);
• and
• storing the two or more DECEKs in association with a manifest of the encrypted content.

A computer-implemented method, comprising:

• obtaining, by one or more processors of a cloud privacy control, a request for access to a content encryption key (CEK), wherein the request is signed using an identity key associated with a first participant of a first privacy domain;
• determining, by the one or more processors, that the request has a valid signature;
• obtaining, by the one or more processors, a manifest associated with the CEK, wherein the manifest encodes a plurality of double-encrypted CEKs (DECEKs);
• determining, by the one or more processors, that a first DECEK of the plurality of DECEKs is encrypted using an end-to-end encryption key (E2EK) associated with the first privacy domain;
• requesting, by the one or more processors, one or more policies;
• evaluating, by the one or more processors, the one or more policies;
• decrypting, by the one or more processors and using a private key associated with the cloud privacy control, the first DECEK to produce a first encrypted content encryption key (ECEK);
• and
• providing, by the one or more processors, the first ECEK in response to the request.