^ One researcher recommended similar approach, the data stored centrally, and give other users access keys as the means of granting them permission to read those data. However the issue here, don't I end up 'storing' that access key as well? Unless its a password-type, where user have to remember and manually enter it every time...

He also suggest taking a push model (the central storage) rather than pull model (device storage).

I am still debating, and researching. Any other thoughts?