Encryption of Cloud-Based Data

Abstract

A method of allowing collaboration on an encrypted document stored in a cloud computing network, the encrypted document associated with a first user having a first user account in the cloud computing network, the method comprising: in response to a request from the first user to share the encrypted document, sending a link to a public network destination to a second user address of a second user; receiving a request via the link from an unconfirmed user to access the data in the encrypted document; requesting of the unconfirmed user to login to a second user account on the cloud computing network; authenticating the identity of the unconfirmed user as the second user; upon authenticating the identity of the unconfirmed user as the second user, decrypting the encrypted document to generate a decrypted document; storing the decrypted document in the first user account; granting the second user access to the decrypted file simultaneously to access granted to the first user; subsequent to the first user or the second user editing the decrypted document, encrypting an edited version of the decrypted document; and storing the edited version of the encrypted document in the first user account.

Claims

1. A method of enabling collaboration by multiple users on an encrypted document stored in a cloud computing network, the encrypted document associated with a first user having a first user account in the cloud computing network, the method comprising: in response to a request from the first user to share the encrypted document, sending a link to a public network destination to a second user address of a second user; receiving a request via the link from an unconfirmed user to access the data in the encrypted document; requesting the unconfirmed user to login to a second user account on the cloud computing network; authenticating the identity of the unconfirmed user as the second user; upon authenticating the identity of the unconfirmed user as the second user, decrypting the encrypted document to generate a decrypted document; storing the decrypted document in the first user account; granting the second user access to the decrypted file simultaneously to access granted to the first user; subsequent to the first user or the second user editing the decrypted document, encrypting an edited version of the decrypted document; and storing the edited version of the encrypted document in the first user account.

2. The method of claim 1, wherein the identity of unconfirmed user as the second user is authenticated if the second user account is associated with the second user address.

3. The method of claim 1, wherein authenticating the identity of unconfirmed user as the second user comprises: sending an authentication message to the second user address; and receiving a input from the unconfirmed user via the second user account based on the authentication message.

4. The method of claim 3, wherein the input is a string contained in the authentication message.

5. The method of claim 3, wherein the input is a link to a public network destination contained in the authentication message.

6. The method of any one of the preceding claims, wherein the second user address is an email address.

7. The method of any one of the preceding claims, wherein the public network destination is a uniform resource locator (URL).

8. The method of any one of the preceding claims, wherein the decrypted document is hidden on the first user account.

9. The method of any one of the preceding claims, further comprising: repeating the steps of encrypting the edited version of the decrypted document and storing the edited encrypted document in the first user account in response to the second user editing the decrypted document or the first user editing the decrypted document.

10. The method of claim 9, wherein the repeating is conducted at regular intervals while the decrypted document is being accessed by one or more of the first user and the second user.

11. The method of any one of the preceding claims, wherein the encrypting of the edited version and storing of the edited encrypted document is performed on closing of the decrypted document by the first user or the second user.

12. The method of any one of the preceding claims, wherein the encrypting of the edited version and storing of the edited encrypted document is performed in response to detecting an edit to the decrypted document.

13. The method of any one of the preceding claims, wherein the second user address is not associated with the cloud computing network.

14. The method of any one of the preceding claims, wherein the second user address is associated with an enterprise.

15. The method of any one of the preceding claims, wherein granting the second user access comprises granting the second user read and/or write access to the decrypted document.

16. The method of any one of the preceding claims, further comprising: requesting that the unconfirmed user register for the second user account on the cloud computing network.

17. A method of enabling collaboration by multiple users on an encrypted document stored in a cloud computing network, the encrypted document associated with a first user having a first user account in the cloud computing network, the method comprising: receiving from the cloud computing network at a second user address of a second user, a link to a public network destination associated with the encrypted document; accessing the link; in response to a request to login to a second user account on the cloud computing network, logging into the second user account; authenticating with the cloud computing network as the second user; upon authenticating as the second user, receiving access to a decrypted version of the encrypted document stored in the first user account, the access granted simultaneously to access being granted to the first user; and accessing the decrypted version of the encrypted document simultaneously to the first user.

18. The method of claim 17, wherein the second user account is associated with the second user and wherein authenticating as the second user comprises logging into the second user account.

19. The method of claim 17, wherein authenticating with the cloud computing network as the second user comprises: receiving an authentication message at the second user address; and providing an input via the second user account based on the authentication message.

20. The method of claim 19, wherein the input is a string contained in the authentication message.

21. The method of claim 19, wherein the input is a link to a public network destination contained in the authentication message.

22. The method of any one of claims 17 to 21, wherein the second user address is an email address.

23. The method of any one of claims 17 to 22, wherein the public network destination is a uniform resource locator (URL).

24. The method of any one of claims 17 to 23, wherein the decrypted document is hidden on the first user account.

25. The method of any one of claims 17 to 24, further comprising editing the decrypted document, wherein after editing the decrypted document, an encrypted version of the edited decrypted document is stored in the first user account of the cloud computing network.

26. The method of any one of claims 17 to 24, further comprising closing the decrypted document, wherein after closing of the decrypted document, an encrypted version of the decrypted document is stored in the first user account of the cloud computing network.

27. The method of any one of claims 17 to 26, wherein the second user address is not associated with the cloud computing network.

28. The method of any one of claims 17 to 27, wherein the second user address is associated with an enterprise.

29. The method of any one of claims 17 to 28, further comprising registering for the second user account on the cloud computing network.

30. The method of any one of claims 17 to 29, wherein receiving access to a decrypted version of the encrypted document stored in the first user account comprises receiving read and/or write access to the decrypted document.

31. A computer readable storage medium having instructions stored thereon which, when executed, cause a processor to perform the method of any one of the preceding claims.

32. A cloud computing system for enabling collaboration by multiple users on an encrypted document associated with a first user, the cloud computing system configured to: store the encrypted document in a first user account in the cloud computing system, the first user account associated with the first user; in response to a request from the first user to share the encrypted document, sending a link to a public network destination to a second user address of a second user; receiving a request via the link from an unconfirmed user to access the data in the encrypted document; requesting the unconfirmed user to login to a second user account on the cloud computing system; authenticating the identity of the unconfirmed user as the second user; upon authenticating the identity of the unconfirmed user as the second user, decrypting the encrypted document to generate a decrypted document; storing the decrypted document in the first user account; granting the second user access to the decrypted file simultaneously to access granted to the first user; subsequent to the first user or the second user editing the decrypted document, encrypting an edited version of the decrypted document; and storing the edited version of the encrypted document in the first user account.

33. The system of claim 32, wherein the identity of unconfirmed user as the second user is authenticated if the second user account is associated with the second user address.

34. The system of claim 32 or 33, wherein authenticating the identity of unconfirmed user as the second user comprises: sending an authentication message to the second user address; and receiving a input from the unconfirmed user via the second user account based on the authentication message.

35. The system of claim 34, wherein the input is a string contained in the authentication message.

36. The system of claim 34, wherein the input is a link to a public network destination contained in the authentication message.

37. The system of any one of claims 32 to 36, wherein the second user address is an email address.

38. The system of any one of claims 32 to 37, wherein the public network destination is a uniform resource locator (URL).

39. The system of any one of claims 32 to 38, wherein the decrypted document is hidden on the first user account.

40. The system of any one of claims 32 to 39, further comprising: repeating the steps of encrypting the edited version of the decrypted document and storing the edited encrypted document in the first user account in response to the second user editing the decrypted document or the first user editing the decrypted document.

41. The system of claim 40, wherein the repeating is conducted at regular intervals while the decrypted document is being accessed by one or more of the first user and the second user.

42. The system of any one of claims 32 to 41, wherein the encrypting of the edited version and storing of the edited encrypted document is performed on closing of the decrypted document by the first user or the second user.

43. The system of any one of claims 32 to 42, wherein the encrypting of the edited version and storing of the edited encrypted document is performed in response to detecting an edit to the decrypted document.

44. The system of any one of claims 32 to 43, wherein the second user address is not associated with the cloud computing system.

45. The system of any one of claims 32 to 44, wherein the second user address is associated with an enterprise.

46. The system of any one of claims 32 to 45, wherein granting the second user access comprises granting the second user read and/or write access to the decrypted document.

47. The system of any one of claims 32 to 46, further comprising: requesting that the unconfirmed user register for the second user account on the cloud computing system.

48. The steps, features, integers, compositions and/or compounds disclosed herein or indicated in the specification of this application individually or collectively, and any and all combinations of two or more of said steps or features.

Description

BRIEF DESCRIPTION OF DRAWINGS

[0014] FIG. 1 is a schematic diagram of a network upon which embodiments of the disclosure are employed;

[0015] FIG. 2 is a process diagram showing an interaction between a first user and a cloud computing network in accordance with embodiments of the disclosure;

[0016] FIG. 3 is a process diagram showing an interaction between a second user and the cloud computing network in accordance with embodiments of the disclosure; and

[0017] FIG. 4 is a process diagram illustrating an encryption and decryption flow between the first user and the cloud computing network shown in FIG. 1.

DESCRIPTION OF EMBODIMENTS

[0018] FIG. 1 is a schematic diagram of a network 100 according to various embodiments of the disclosure, the network 100 comprising a cloud computing network 102, and a plurality of users 104. Whilst embodiments will be described in relation to a first and a second user 104a, 104b of the plurality of users 104, it will be appreciated that any number of users 104 may be party to the network 100.

[0019] Optionally, the network 100 further comprises an enterprise server 106 associated with an enterprise. One or more of the users 104 may also be associated with the enterprise and thus have access to the enterprise server 106. For example, one or more of the users 104 may have an email account hosted on the enterprise server 106.

[0020] The cloud computing network 102 provides cloud computing services to at least the first user 104a of the plurality of users. Preferably, however, each of the users 104 has an account with the cloud computing network 102. Each user of the plurality of users 104 being provided with cloud computing services by the cloud computing network 102 may have a user account.

[0021] Cloud computing services provided by the cloud computing network 102 may include but are not limited to a file storage service 102a, a file editing service 102b, an encryption service 102c, an authorisation service 102d, and an authentication service 102e.

[0022] The file storage and editing services 102a, 102b may allow for the storage and editing of documents uploaded by users via the network 100. In particular, the editing service may allow two or more of the users 104 to collaboratively edit a single document at the same time. The file storage service 102a additionally allows for documents to be stored in the cloud computing network 102 in encrypted or decrypted format. The editing service 102a, however, may only allow for decrypted clear documents to be viewed and/or edited.

[0023] The encryption service 102c is provided to encrypt documents uploaded before or after storage in the cloud computing network. The encryption service 102c may be configured to encrypt documents using public-private key encryption or the like. The encryption service 102c may be configured to encrypt documents using symmetric and/or asymmetric encryption. The encryption technique use may be defined by the user or the cloud computing network. Encryption keys may also be defined by the user or automatically generated by the cloud computing network 102.

[0024] If symmetric encryption is used, the same key may be used to encrypt and decrypt documents. Upon uploading decrypted documents to the cloud computing network, a user can rely on the cloud computing network 102 to encrypt and decrypt such documents when required.

[0025] Where asymmetric encryption is used (e.g. public-private key encryption), a user may encrypt documents to be uploaded using a public key having a paired private key to decrypt, such that the user can encrypt documents before uploading them to the cloud computing network. By doing so, further protection is provided to data contained in the document being uploaded as it is transmitted to the cloud computing network 102.

[0026] The authorisation service 102d is provided to control access to documents stored in a user's account with the cloud computing network 102. For example, one of the plurality users 104 of the network may wish for other users 104 of the network 100 to be provided with access to one or more documents stored in their user account that they hold with the cloud computing network 102. The authorisation service 102e acts to manage access to such documents based on instructions from that user (the cloud computing network account holder). The authorisation service 102e may also act to manage access to these documents based on instructions from the enterprise server 106. For example, a document stored in the cloud computing network 102 may be associated with the enterprise server 106. In which case, the enterprise 106 may communicate with the cloud computing network 102 to implement one or more rules associated with how the document is managed, as will be described in more detail below.

[0027] The authorisation service 102d may also be operable to generate a link to a public network destination (e.g. a URL) associated with a document that an account user wishes to share with others. The authorisation service 102d may only generate such a link if the associated document is encrypted. The authorisation service 102d may be further configured to send such a link to a third party, in response to a request to do so from a user of the plurality of users 104 or the enterprise server 106.

[0028] The authentication service 102e is provided to authenticate the identity of a user wishing to be granted access to documents stored in a user account on the cloud computing network 102. For example, the authentication service 102e may be configured to verify the identity of users who receive links to public network destinations generated by the authorisation service 102d, to check that the recipient of the link is authorised by another user or the enterprise server 106 to access an associated document.

[0029] As mentioned above, the enterprise 106 or the cloud computing network 102 itself may implement one or more rules associated with how an encrypted document (or a decrypted version of that document) is shared with users of the cloud computing network 102. In some embodiments, such rules may restrict the amount of time a decrypted version of an encrypted document is made available for participants to access before a user is required to undergo authorisation/authentication again. In some embodiments, rules may determine whether particular authentication technique(s), such as SMS verification, email verification etc., are required to authenticate a user. Additionally or alternatively, rules may be used to control access based on geolocation data associated with users collected by the authorisation service 102d and/or the authentication service 102e during authorisation of one or more of the plurality of users 104. For example, during authentication, the authentication service 102e may capture the geolocation of a user requesting access to a particular document. Based on the captured geolocation data, the rules may determine whether or not to grant access to a decrypted version of the document in question. In another example, the authentication service 102e may detect unsafe networks (e.g. public Wifi networks) or connections via virtual private networks (VPNs) and the rules may prevent access to decrypted files when a user requests access to a decrypted document via such networks. In yet another example, In yet another example, the authentication service 102e may determine the make and/or model of the device being used by a user to communicate with the cloud computing network 102. Rules may restrict access to documents stored in the network 102 depending on the make and/or model of the device, for security purposes. In another example, the authentication service 102e may determine the operating system being used by a user to communicate with the cloud computing network 102. Rules may then restrict access to documents stored in the network 102 depending on the operating system being used or whether to operating system in question requires a security update.

[0030] An exemplary method for managing access to a document stored on the cloud computing network in a first user account will now be described with reference to FIGS. 2 to 4.

[0031] Referring first to FIG. 2, a process 200 for storing an encrypted document on the cloud computing network 102 is illustrated. At step 202, the first user 104a logs into his account on the cloud computing network 102, herein referred to as the first user account. The first user 104a then uploads a document to the first user account at step 204. The encryption service 102c on the cloud computing network 102 encrypts the document which is then stored in the first user account. At step 206, the first user 104a then requests to the cloud computing network 102 for the encrypted document to be shared with a second user address associated with the second user 104b of the network.

[0032] It will be appreciated that at the time of requesting the sharing of the document with the second user 104b, the second user 104b need not have an account with the cloud computing network 102. To that end, the first user 104a can request that an encrypted document is shared with any user so long as that user has a network address of one form or other. The second user address may, for example, be an email address which may or may not be associated with either the cloud computing network 102 or the enterprise service 106. In some embodiments, the second user address may not be an address associated with the network 100. For example, the second user address can, in some embodiments, be a telephone number.

[0033] Since the document which is to be shared is encrypted, the first user 104a is able to share the document with the second user 104b without needing to know the details of an account he may or may not have with the cloud computing network 102. The first user 104a can simply use any address he has for the second user 104b to share the document with the second user 104b.

[0034] Referring now to FIG. 3, a process 300 for granting access to the document shared by the first user 104a in the process described with reference to FIG. 2 will now be described. At step 302 and in response to a request from the first user 104a to share the encrypted document with the second user 104b, the authorisation service 102d may generate and send a link to the second user address. As mentioned above, in some embodiments, the second user address is an email address or a telephone number which the first user 104a has provided to the cloud computing network 102 to identify the second user 104b.

[0035] Upon receipt of the link at the second user address, the second user 104b accesses link at step 304. By accessing the link, a request is sent to the cloud computing network 102 to grant the second user 104b access to the document. At step 306, the cloud computing network 102 may optionally grant the second user 104b access to the document in its encrypted form without requiring authentication, since decryption of the document is only possible by the encryption service 102c hosted on the cloud computing network 102. However, before the second user 104b can access a decrypted version of the document shared by the first user 104a, the second user 104b must login to an account on the cloud computing network 102.

[0036] Accordingly, at step 308, the second user 104b is prompted to login to their account, herein after referred to as the second user account. If, the second user 104b does not have an account with the cloud computing network 102, the second user 104b may be prompted to register for an account and subsequently login to the account (the second user account).

[0037] At this point, the authenticity of the second user 104b may be determined in one of several ways.

[0038] In one embodiment, if the second user address to which the link was sent at step 302 is associated the second user account which the second user 104b logged in to at step 308, then the authentication service 102e may determine that the person who accessed the link at step 304 and subsequently logged in to the second user account is the intended recipient of the link and thus can be authenticated as the second user 104b. In which case, steps 312 to 316 of the process 300 shown in FIG. 3 may be skipped and access to an decrypted version of the document may be granted right away at step 318.

[0039] In another embodiment, whether or not the second user address to which the link was sent at step 302 is determined to be associated with the second user account, the authentication service may request at step 310 that the second user authenticate their identity as the intended recipient of the link sent at step 302.

[0040] In some embodiments, at step 312 an authentication message is sent by the authentication service 102e to the second user address. Then, at step 314, the authentication service may request that the second user 104b provide a response to the authentication message, for example, via the second user account. In some embodiments, that response may be to relay some or all of the contents of the authentication message to the cloud computing network at step 314. For example, the second user 104b may be requested to input part or all of the authentication message into a user interface of the cloud computing network 314.

[0041] At step 316, the second user 104b can then provide the requested response based on the authentication message received at the second user address (which the second user has access to). On receipt of a valid response from the second user, at step 318 the authentication service may then grant the second user access to a decrypted version of the document associated with the link sent at step 302. If an decrypted version of the document does not currently exist, the encryption service may generate a decrypted version of the document and grant access both to the first user 104a and the second user 104b.

[0042] In a variation of the above, instead of the second user 104b providing a response in the form of an input at the cloud computing network, the authentication message may include a link to a public network destination which is sent to the second user address. With the second user 104b logged into the second user account, accessing of the link by the second user 104b may be sufficient to prove the identity of the second user 104b since only the second user 104b has access to messages sent to the second user address. Accessing of the link in the authentication message may then cause the authentication service 102e to grant access to the decrypted document.

[0043] In a further variation, instead of the authentication service 102e sending a authentication message to the second user address, the authentication message may be sent to a different address which has been confirmed by the first user 104a or the enterprise server 106 as being associated with the user to which the link sent at step 302 was intended, i.e. the second user 104b. For example, the different address may be a telephone number and the verification code may be sent via an instant messaging service (such as in an SMS, a MMS, an iMessage or a Whatsapp message.

[0044] It will be appreciated that the processes described above with reference to FIGS. 2 and 3 for managing access to a document in relation to the first and second users 104a, 104b may be applied to the management of the document for any number of users of the network. Additionally, these processes are not limited to above described scenario in which the first user 104a wishes to share a document with the second user 104b. Subject to system constraints, in accordance with embodiments described above, the cloud computing network 102 may be configured to manage the encryption and access rights of any number of documents stored in any number of formats in any number of user accounts on the cloud computing network to any number of users of the cloud computing network 102.

[0045] Once access has been granted to a decrypted version of the document, the cloud computing network 102 can provide means for users for whom access has been granted to collaborate on a document by simultaneously viewing and editing the document whilst maintaining an encrypted version in the first user account. To that end, FIG. 4 schematically illustrates the process 400 of maintaining security of the decrypted version of a document uploaded to the cloud computing network by the first user.

[0046] As mentioned previously with reference to FIG. 2, the first user 104a can upload a decrypted document 402 to the cloud computing network 102 as denoted by arrow 404 in FIG. 4. The encryption service 102b on the cloud computing network 102 then encrypts and stores the encrypted version 406 of the document in the first user account of associated with the first user 104a. The decrypted version 402 of the document uploaded to the first user account may then be deleted. When access 408 to the document is granted to either the first user 104a or another user who has undergone authorisation and authentication in accordance with embodiments described above, the encrypted document is then decrypted and a decrypted version 410 of the document is stored in the first user account. After the document has been modified 412 by the one or more users to which access has been granted, the encryption service 102c may then encrypt a modified version of the document and store the modified encrypted document in the first user account.

[0047] When the modified encrypted version is stored, the earlier encrypted version may be deleted. Alternatively, one or more earlier encrypted versions may be kept so that a user can step back through versions during multiple edits.

[0048] The file location of the decrypted version 410 of the document may be hidden on the first user account to prevent users from copying the decrypted version of the document once they have been granted access thereto. The encrypted document 406, however, need not be hidden due to its encryption.

[0049] It will be appreciated by persons skilled in the art that numerous variations and/or modifications may be made to the above-described embodiments, without departing from the broad general scope of the present disclosure. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.