Portable digital vault and lending of same

A method of providing a portable digital vault, the method comprising, at an issuing authority computing device:

• receiving a computing device identifier from a receiving computing device;
• generating the portable digital vault, the portable digital vault comprising:
• a contents module comprising content that is encrypted;
• a transfer module;
• a rendering module configured to output the content at the receiving computing device in unencrypted form or to provide a secure interface to software external to the portable digital vault configured to output the content at the receiving computing device;
• an identity module comprising a vault certificate, the vault certificate comprising a validity test condition specifying the computing device identifier from the receiving computing device, wherein the contents module, the transfer module and the rendering module can only be executed on a computing device associated with a computing device identifier that matches the computing device identifier from the receiving computing device;
• and
• a rights module comprising one or more authentication certificates, at least one authentication certificate associated with a delegable right, wherein the delegable right is a right to transfer ownership of the content of the portable digital vault from the receiving computing device to one or more subsequent owners of the portable digital vault;
• and
• sending the portable digital vault to the receiving computing device;
• wherein after the portable digital vault is sent to the receiving computing device, a copy of the portable digital vault is not stored at the issuing authority computing device.

A method of transferring a portable digital vault from a sending computing device to a receiving computing device, the method comprising:

• requesting a receiving computing device identifier;
• generating an encryption key based on the receiving computing device identifier;
• binding the portable digital vault to the receiving computing device identifier, the binding comprising encrypting contents of the portable digital vault with the encryption key, the portable digital vault comprising:
• a contents module comprising the encrypted contents;
• a transfer module;
• a rendering module configured to output the contents at the receiving computing device in unencrypted form or to provide a secure interface to software external to the portable digital vault configured to output the contents at the receiving computing device;
• an identity module comprising a vault certificate, the vault certificate comprising a validity test condition specifying the receiving computing device identifier, wherein the contents module, the transfer module and the rendering module can only be executed on a computing device associated with a computing device identifier that matches the receiving computing device identifier;
• a rights module comprising one or more authentication certificates, at least one authentication certificate associated with a delegable right, wherein the delegable right is a right to transfer ownership of the contents of the portable digital vault from the receiving computing device to one or more subsequent owners of the portable digital vault;
• and
• sending the portable digital vault to the receiving computing device.