Method and system for secure data sharing

1. A method of protecting data, the method comprising:

encrypting a data in a protected data item using a first encryption key, the protected data item being associated with a trust boundary, where one or more other protection data items may also be associated with the trust boundary, the data encrypted in the protected data item being accessible to a defined set of users associated with the trust boundary by using a third encryption key and being inaccessible to users not associated with the trust boundary, the third encryption key being uniquely associated with the trust boundary; and

encrypting the first encryption key in the protected data item using a second encryption key that is unique to the protected data item,

wherein the unique second encryption key is derived from the third encryption key, and prior to encrypting the first encryption key, receiving the third encryption key at a computing device, associated with a user in the defined set of users associated with the trust boundary, from another computing device.

2. The method of claim 1 , wherein the unique second encryption key is derived from both the third encryption key and a cryptographic salt that is randomly generated from the protected data item.

3. The method of claim 1 , wherein the data is encrypted to a payload portion of the protected data item.

4. The method of claim 1 , wherein the first encryption key is encrypted to a header portion of the protected data item.

5. The method of claim 1 , wherein the data comprises a file.

6. The method of claim 1 , wherein the data comprises a document.

7. The method of claim 1 , wherein the data comprises a folder.

8. The method of claim 7 , wherein the data further comprises the contents of the folder.

9. The method of claim 1 , wherein the data comprises files, documents, or folders.

10. A system for protecting data, the system comprising:

a computer processor in combination with an encryption component for encrypting a data in a protected data item using a first encryption key, the protected data item being associated with a trust boundary, where one or more other protection data items may also be associated with the trust boundary, the data encrypted in the protected data item being accessible to a defined set of users associated with the trust boundary by using a third encryption key and being inaccessible to users not associated with the trust boundary, the third encryption key being uniquely associated with the trust boundary, and the processor and encryption component for encrypting the first encryption key in the protected data item using a second encryption key that is unique to the protected data item,

wherein the unique second encryption key is derived from the third encryption key, and a computing device, associated with a user in the defined set of users associated with the trust boundary, comprises the computer processor, and the computer processor is configured to receive from another computing device, prior to encrypting the first encryption key, the third encryption key.

11. The system of claim 10 , wherein the unique second encryption key is derived from both the third encryption key and a cryptographic salt that is randomly generated from the protected data item.

12. The system of claim 10 , wherein the data is encrypted to a payload portion of the protected data item.

13. The system of claim 10 , wherein the data comprises a file.

14. The system of claim 10 , wherein the data comprises a document.

15. The system of claim 10 , wherein the data comprises a folder.

16. The system of claim 13 , wherein the data further comprises the contents of the folder.

17. The system of claim 10 , wherein the data comprises files, documents, or folders.