A system encrypts digital content data with a key of a content encryption key (CEK) pair and CEK related share data available to an end user station including a source for generating source encrypted data including content data. The share data is encrypted with a first key of a second encryption key pair associated with a targeted intermediate station including a processor receiving source encrypted data and being in data communication with a portable storage device associated with the end user station, which is associated with a third encryption key pair. The processor generates intermediate station encrypted data by decrypting encrypted share data using a key of the second key pair and encrypting resulting decrypted data using a key of the third key pair. A reconstruction processor uses an algorithm and input share data to reconstruct the CEK. A decryption processor uses the reconstructed CEK to decrypt encrypted content data.