I have wondered around and am unable to come out with a proper solution for the below requirements, would seek your kind advice. It is similar to Which strategy to encrypt data accessed by multiple users? but there is additional complexity/requirements
- Data must be encrypted in database
- Currently there are two databases, one holding user credentials (DB1), one holding personal data (DB2)
- Both must be encrypted
- DB2 can only be accessed through whitelist
- Data must be encrypted in transport
- REST Communication between AWS Server and Mobile APP
- Data is scoped to user accounts
- Each user owns his data, associated by a userId
- Encrypted data owner can give access to his data (in DB2) to other users
- Only read access is required
- Access granted in #4 can be revoked by the owner or himself
- Data owner can revoke another user's access to his data
- Data accessor can revoke his own access to owner's data
- Data can be recovered when user password is forgotten
- Data owner can recover his data even if he lost his password through recovery email
Appreciate the guidance and help
