Method and system for securing digital assets using process-driven security policies

A method for imposing access restrictions on an electronic document, comprising:

• associating, by one or more computing devices, an electronic document with at least a first state of a plurality of states of a process-driven security policy, the first state associated with a classifier and with an identifier representing a user or a group of users, with different states having different set of access restrictions;
• imposing the set of access restrictions associated with the first state on the electronic document by encrypting, by the one or more computing devices, at least a portion of the electronic document using a group key corresponding to the identifier and a state key corresponding to the classifier and requiring at least both the group key and the state key to decrypt at least the portion of the electronic document;
• and
• changing, by the one or more computing devices, the state of the process-driven security policy for the electronic document automatically without user or administrator interaction from the first state to a second state in response to an internal or external system event, wherein the changed state is based on a transition rule associated with the event.

A tangible computer-readable medium having stored thereon computer-executable instructions that, if executed by a computing device, cause the computing device to perform a method for imposing access restrictions on an electronic document, the method comprising:

• associating an electronic document with at least a first state of a plurality of states of a process-driven security policy, the first state associated with a classifier and with an identifier representing a user or a group of users, with different states having different set of access restrictions;
• imposing the set of access restrictions associated with the first state on the electronic document by encrypting at least a portion of the electronic document using a group key corresponding to the identifier and a state key corresponding to the classifier and requiring at least both the group key and the state key to decrypt at least the portion of the electronic document;
• and
• changing the state of the process-driven security policy for the electronic document automatically without user or administrator interaction from the first state to a second state in response to an internal or external system event, wherein the changed state is based on a transition rule associated with the event.