Secure file sharing method and system

65:

• The method of claim 64, wherein the symmetric key comprises a data encryption key (DEK), wherein the public key comprises a key encryption key (KEK), and wherein the data encryption key is encrypted using the key encryption key prior to storage of the encrypted key.

66:

• The method of claim 64, wherein the encrypted key is generated and stored in a key management service separate from the remote storage location of the encrypted data.

67:

• The method of claim 64, wherein the encrypted data is stored as one or more objects in an object storage system, and wherein each portion of the encrypted data corresponds to a distinct storage object.

68:

• The method of claim 64, wherein the plurality of portions of the encrypted data are stored redundantly across a plurality of storage nodes to increase availability.

69:

• The method of claim 64, wherein access to the encrypted key is conditioned on authentication of a user device via an identity management service.

70:

• The method of claim 64, wherein decryption of the encrypted data is performed at a user device using the symmetric key after retrieval of the encrypted key.

71:

• The method of claim 64, wherein a storage service stores the encrypted data, and wherein a separate key management service controls access to the symmetric key.

72:

• The method of claim 64, further comprising:
• logging access events associated with retrieval or decryption of the encrypted key.

73:

• The method of claim 64, wherein the plurality of portions of the encrypted data comprises a plurality of shares generated using a threshold-based scheme, wherein reconstruction of the encrypted data requires access to at least a predetermined minimum number of the plurality of shares, and wherein the predetermined minimum is less than a total number of the plurality of shares.

75:

• The system of claim 74, wherein the symmetric key comprises a data encryption key (DEK), wherein the public key comprises a key encryption key (KEK), and wherein the data encryption key is encrypted using the key encryption key prior to storage of the encrypted key.

76:

• The system of claim 74, wherein the encrypted key is generated and stored in a key management service separate from the remote storage location of the encrypted data.

77:

• The system of claim 74, wherein the encrypted data is stored as one or more objects in an object storage system, and wherein each portion of the encrypted data corresponds to a distinct storage object.

78:

• The system of claim 74, wherein the plurality of portions of the encrypted data are stored redundantly across a plurality of storage nodes to increase availability.

79:

• The system of claim 74, wherein access to the encrypted key is conditioned on authentication of a user device via an identity management service.

80:

• The system of claim 74, wherein decryption of the encrypted data is performed at a user device using the symmetric key after retrieval of the encrypted key.

81:

• The system of claim 74, wherein a storage service stores the encrypted data, and wherein a separate key management service controls access to the symmetric key.

82:

• The system of claim 74, wherein the at least one hardware processor is further configured to:
• log access events associated with retrieval or decryption of the encrypted key.

83:

• The system of claim 74, wherein the plurality of portions of the encrypted data comprises a plurality of shares generated using a threshold-based scheme, wherein reconstruction of the encrypted data requires access to at least a predetermined minimum number of the plurality of shares, and wherein the predetermined minimum is less than a total number of the plurality of shares.