Method for flexible data protection with dynamically authorized data receivers in a content network or in cloud storage and content delivery services

A computer program product comprising computer executable instructions stored on a non-transitory medium that when executed by a processor in a Central Processing Unit (CPU) cause the processor to:

• encrypt a content object using a data encryption key to obtain an encrypted content object;
• re-encrypt the encrypted content object using a secret key to obtain a dual-encrypted content object;
• publish the dual-encrypted content object to the cloud service to obtain a published content object;
• distribute a group decryption key for decrypting the published content object to a plurality of users in a group via a content delivery network (CDN);
• distribute an updated group decryption key for the users in the group when a user joins, when a user leaves, and when a user is revoked from the group;
• and
• forward an updated re-encryption key to the cloud service for re-encrypting the published content object,
• wherein the published content object is stored in the cloud service and comprises a first component that depends on a random secret and a secret key, a second component that depends on the random secret and a data encryption key, and a third component that depends on the random secret and the content object, and
• wherein the first component and the second component is smaller in data size than the third component.

An apparatus for protecting content in a network comprising:

• a memory;
• a transmitter;
• a processor in a Central Processing Unit (CPU) coupled to the transmitter and the memory, wherein the memory contains instructions that when executed by the processor cause the apparatus to:
• encrypt a content object using a data encryption key to obtain an encrypted content object;
• re-encrypt the encrypted content object using a secret key to obtain a dual-encrypted content object;
• publish the dual-encrypted content object to a cloud service to obtain a published content object;
• distribute a group decryption key for decrypting the published content object to a plurality of users in a group via a content delivery network (CDN);
• distribute an updated group decryption key for the users in the group when a user joins the group, when a user leaves the group, and when a user is revoked from the group;
• and
• forward an updated re-encryption key to the cloud service for re-encrypting the published content object,
• wherein the published content object is stored in the cloud service and comprises a first component that depends on a random secret and a secret key, a second component that depends on the random secret and a data encryption key, and a third component that depends on the random secret and the content object, and
• wherein the first component and the second component is smaller in data size than the third component.