I have wondered around and am unable to come out with a proper solution for the below requirements, would seek your kind advice. It is similar to Which strategy to encrypt data accessed by multiple users? but there is additional complexity/requirements

  1. Data must be encrypted in database
  • Currently there are two databases, one holding user credentials (DB1), one holding personal data (DB2)
  • Both must be encrypted
  • DB2 can only be accessed through whitelist
  1. Data must be encrypted in transport
  • REST Communication between AWS Server and Mobile APP
  1. Data is scoped to user accounts
  • Each user owns his data, associated by a userId
  1. Encrypted data owner can give access to his data (in DB2) to other users
  • Only read access is required
  1. Access granted in #4 can be revoked by the owner or himself
  • Data owner can revoke another user's access to his data
  • Data accessor can revoke his own access to owner's data
  1. Data can be recovered when user password is forgotten
  • Data owner can recover his data even if he lost his password through recovery email

Appreciate the guidance and help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.