Mediator monitoring and controlling access to electronic content

1. A method of a mediator monitoring and controlling access to an electronic content, comprising:

receiving, by a mediator server of a mediator, a second share SK G2 from an owner server, wherein a first share SK G1 is provided to a member server of a member of a group by the owner server;

wherein the group is created by the owner server generating a group public key PK G and a group secret key SK G ;

wherein the member is added by the owner server to the group by generating the first share SK G1 from the group secret key SK G and a public key of the member, and the second share SK G2 from the group secret key SK G and a public key of the mediator;

wherein a user publishes an electronic content for the group, comprising the user encrypting the electronic content to the group public key PK G , wherein the electronic content includes a header and a payload; and

wherein the member obtains the encrypted electronic content;

further comprising;

the mediator receiving a request from the member for mediation, comprising the mediator receiving a dispatch of the header of the encrypted electronic content;

the mediator receiving a request, by the member, for mediation, comprising the mediator receiving a dispatch of the header of the encrypted electronic content from the member;

determining, by the mediator, whether the member is eligible to decrypt the electronic content, if eligible, the mediator responding to the request for mediation with a member accessible header, wherein the member accessible header includes the header after application of SK G2 ;

wherein the member obtains a secret based on SK G1 and the member accessible header; and

wherein the member decrypts the payload of the electronic content using the secret.

2. The method of claim 1 , further comprising the mediator logging requests by the member, eligibility determinations, and mediator responses.

3. The method of claim 2 , wherein logging comprises the mediator storing the requests by the member, eligibility determinations, and mediator responses at a server, wherein the server is accessible by the owner and others.

4. The method of claim 2 , wherein logging comprises the mediator dispatching alerts of the requests by the member, eligibility determinations, and mediator responses to the owner and others.

5. The method of claim 1 , wherein determining whether the member is eligible comprises the mediator being notified by the owner prior to the mediation request.

6. The method of claim 1 , wherein determining whether the member is eligible comprises the mediator being notified by the owner or another authority prior to the mediation request that the member's public key in invalid.

7. The method of claim 1 , wherein if the payload is greater than a threshold in size, the header includes a secret needed to decrypt the payload.

8. The method of claim 1 , wherein if the payload is less than a threshold in size, the header is the payload.

9. The method of claim 1 , wherein the mediator, the publisher and the member publish public keys and secure corresponding secret keys.

10. The method of claim 1 , wherein an opaque watermark in the header is embedded by the publisher, and further comprising:

logging, by the mediator, the header when received by the mediator from the member, thereby allowing the publisher to track the electronic content.

11. The method of claim 1 , wherein the publisher inserts an electronic content specific policy in the header, wherein only the mediator can decrypt the policy, and wherein the electronic content specific policy provides additional instructions regarding eligibility of the member.

12. The method of claim 11 , wherein the policy directs the mediator to request mediation from a higher mediator authority.

13. A mediator server operative to monitor and control access to an electronic content, comprising a mediator of the mediator server operative to:

receive a second shares SK G2 from an owner server, wherein a first share SK G1 is provided to a member server of a member by the owner server;

wherein a group is created by the owner server comprising generating a group public key PK G and a group secret key SK G ;

wherein the member is added by the owner server to the group by generating the first share SK GI from the group secret key SK G and a public key of the member, and the second share SK G2 from the group secret key SK G and a public key of the mediator;

wherein a user publishes an electronic content for the group, comprising the user encrypting the electronic content to the group public key PK G , wherein the electronic content includes a header and a payload; and

wherein the member obtains the encrypted electronic content;

the mediator of the mediator server further operative to:

receive a request from the member for mediation, comprising the mediator receiving a dispatch of the header of the encrypted electronic content;

receive a request, by the member, for mediation, comprising the mediator receiving a dispatch of the header of the encrypted electronic content from the member;

determine whether the member is eligible to decrypt the electronic content, if eligible, the mediator responding to the request for mediation with a member accessible header, wherein the member accessible header includes the header after application of SK G2 ;

wherein the member obtains a secret based on SK G1 and the member accessible header; and

wherein the member decrypts the payload of the electronic content using the secret.

14. The mediator server of claim 13 , wherein the mediator is further operative to log requests by the member, eligibility determinations, and mediator responses.

15. The mediator server of claim 14 , wherein logging comprises the mediator storing the requests by the member, eligibility determinations, and mediator responses at a server, wherein the server is accessible by the owner and others.

16. The mediator server of claim 14 , wherein logging comprises the mediator dispatching alerts of the requests by the member, eligibility determinations, and mediator responses to the owner and others.

17. The mediator server of claim 13 , wherein the mediator is further operative determine whether the member is eligible comprises the mediator being notified by the owner prior to the mediation request.

18. The mediator server of claim 13 , wherein determining whether the member is eligible comprises the mediator being notified by the owner or another authority prior to the mediation request that the member's public key in invalid.

19. The mediator server of claim 13 , wherein if the payload is greater than a threshold in size, the header includes a secret needed to decrypt the payload.

20. The mediator server of claim 13 , wherein if the payload is less than a threshold in size, the header is the payload.