I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography.
I'm concerned about how it is possible to share access of encrypted data with N entities, be able to revoke any of them at anytime, and do this securely.
I've thought about a cryptography function that I'm asking here some help to build.
Let's imagine I have a public data base encrypted with my public key.
- to share some data from my encrypted DB (my email address for example) to 3 different entities (applications)
- these 3 applications and only these to be able to read the data
- to be able as a user to revoke their access to this data at any time.
I have a private/public key and these applications' owners too have a private/public key on the network.
I use a function to encrypt my email with my public key as:
At this point, only I with my private Key can read the data.
If I give access to a 3rd-party application to it, then I would re-encrypt my email with a new function, using my public key and the application's, so both my private key and the application private key are solution and can decrypt the data:
Encrypt(Email, (MyPublicKey, AppPublicKey))
So, now, only me and the application could read the data with our private key because each of our private keys would be a solution of this encryption algorithm.
If I add a 2nd application access to this data, I would then re-encrypt the data through a new function:
Encrypt(Email, (MyPublicKey, AppPublicKey, 2ndAppPublicKey))
Now the 2nd application has the same access as me and the first application to this data.
Then if I want to revoke the 1st application's access, I would re-encrypt the data excluding the 1st application private key as solution of the function as:
Encrypt(Email, (MyPublicKey, 2ndAppPublicKey))
So, the 1st application cannot access to the data anymore as its private Key is not solution anymore of the encryption function.
Is it a known cryptographic scheme (like custom shared secret)? Does such mathematical function exist? What it would look like? Maybe there is a simpler solution I didn't see...