An encryption method for encrypting sensitive information in a computer environment that describes a method for Hierarchical Identity Based Encryption.

An earlier (2002) description of hierarchy cryptography that [[prior art 1]] builds on.

A Hierarchical Identity Based Encryption (HIBE) system

This paper contains the first hierarchical identity-based encryption scheme. Here, each user in the system is identified by a vector of strings, e.g., (com, microsoft, steveballmer) and has a decryption key corresponding to this vector. Each user can derive decryption keys for its "descendants", e.g., the owner of secret key (com, microsoft) can derive keys for any user (com, microsoft, *), (com, microsoft, *, *) etc.

This paper gives a scheme to ensure secrecy of previously encrypted messages even if the decryption keys are leaked at some point in the future. The construction makes clever use of the key hierarchy in hierarchical identity-based encryption schemes.

This paper presents the first public-key searchable encryption scheme. Hereby, the owner of a decryption key can give away a piece of trapdoor information to a third party so that the latter can test whether an encrypted ciphertext contains a certain keyword, but cannot obtain any information about the encrypted plaintext beyond that fact.

This paper makes the relation between (hierarchical) identity-based encryption and searchable encryption explicit, and also provides extensions such as ID-based searchable encryption and temporarily searchable encryption that make clever use of the hierarchical key structure.

This paper presents policy-based encryption and signature schemes with respect to credential-based policies formalized as boolean expressions written in generic conjunctive-disjunctive normal form.

This paper generalizes the key hierarchy so that "wildcard" can occur anywhere in the vector, not just at the end. E.g., the owner of the key (*, microsoft, steveballmer) can generate the decrypt key for (com, microsoft, steveballmer), (ca, microsoft, steveballmer), etc.