Management of encryption key updates based on user group activity

Abstract

The present disclosure provides enhanced management of encryption key updates based on user group activity. The system utilizes a combination of vault keys and other security keys to control access to secret data shared by members of a group participating in a collaborative session, such as a channel or chat session. The vault keys allow the system to control access to secret data by users who join a particular group, while immediately restricting access to users who leave the group. Updates to the keys are initiated based on the activities of members of the group, which activities can include, but are not limited to, threshold changes in the number of group members, the total number of group members, the amount of data shared between group members, and / or the age of one or more keys used to protect data shared by the group.

Description

Background Art

[0001] The resources required to manage systems that store secret data can present challenges to companies of all sizes. If not managed properly, human error or mismanaged maintenance tasks can lead to security issues. When data centers serve large user groups, management costs and exposure to various forms of risk increase significantly. When such systems have high user churn rates, security risks are further increased.

[0002] Additional challenges may arise when a third-party entity is used to store secret data. For example, a particular company may use a third-party service to store secret data. Although such a service may provide a higher level of security against certain types of threats compared to a self-managed turnkey system, there may be a number of disadvantages for companies that wish to maintain a high level of security against malicious users or even administrators of the third-party service.

[0003] It is with respect to these and other considerations that the disclosure herein is presented. Summary of the invention

[0004] The technology described herein provides enhanced management of encryption key updates based on user activity of a storage vault. The system utilizes a combination of vault keys and other security keys to control access to secret data shared by members of a group participating in a collaborative session (such as a channel, chat session, conference, etc.). The vault keys allow the storage system to grant access to secret data for users who join a particular group (e.g., a channel), while immediately restricting access from users who leave the group. The technology described herein can enhance the security of the storage system by performing maintenance updates to the keys based on the activity of the members of the group, while minimizing the use of management resources and computing resources.

[0005] In some configurations, the system can determine when the activity of a group of users meets one or more criteria. When the user activity meets one or more criteria, the system can instruct one or more remote client devices to update one or more encryption keys used to protect secret data shared by members of the group. The criteria can be based on changes in the number of members of the group. This can include changes in the membership of the group, such as a threshold number of people joining the group or a threshold number of people leaving the group. The system can also cause the client device to update the security key when the total number of users of the group exceeds or falls below one or more thresholds. A combination of factors including changes in one or more loss rates, the age of one or more keys, and / or the amount of data shared by members of the group can also cause the system to update the selection combination of keys, including vault keys and other symmetric and asymmetric keys associated with the vault keys.

[0006] It should be appreciated that the above subject matter can be implemented as a computer-controlled device, a computer process, a computing system, or as an article such as a computer-readable storage medium. These and various other features will be apparent by reading the following detailed description and viewing the associated drawings.

[0007] This Summary is provided to introduce a selection of concepts in a simplified form that are further described in the Detailed Description below. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to use this Summary to limit the scope of the claimed subject matter. Furthermore, the claimed subject matter is not limited to implementations that address any or all of the disadvantages noted in any part of this disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The detailed description is described with reference to the accompanying drawings. In the drawings, the leftmost digit(s) of a reference number identifies the drawing in which the reference number first appears. The same reference numbers in different drawings indicate similar or identical items. References to individual items of multiple items can use reference numbers with letters in the alphabetical sequence to refer to the individual items or instances. Generic references to items can use specific reference numbers without the alphabetical sequence.

[0009] Figure 1 is a block diagram illustrating several exemplary components of a system for providing enhanced security for encrypted data using vault keys for groups of users.

[0010] Figure 2A is a block diagram illustrating stages in a process for storing encrypted data using a vault key for a group of users defined by a roster of a communication system.

[0011] Figure 2Bis a block diagram illustrating a process for verifying a user's membership in a particular group.

[0012] Figure 2C is a block diagram showing the state of a server storing encrypted data using a vault key for a group of users.

[0013] Figure 2D is a block diagram illustrating the stages of a process for requesting access to encrypted data stored using a vault key for a group of users.

[0014] Figure 2E is a block diagram illustrating a process for verifying a user's membership in a particular group.

[0015] Figure 2F is a block diagram illustrating another stage of a process for requesting access to encrypted data stored using a vault key for a user's group.

[0016] Figure 2G is a block diagram illustrating the status of multiple client computers after accessing secret data from a server.

[0017] Figure 3A is a block diagram illustrating aspects of a system for controlling access to stored data protected using a vault key for a group of users.

[0018] Figure 3B is a block diagram illustrating aspects of a process for controlling access to stored data protected using a vault key for a group of users.

[0019] Figure 3C is a block diagram illustrating aspects of a group manager for confirming membership of a group.

[0020] Figure 3D is a block diagram of other aspects of a process for controlling access to stored data protected using a vault key for a group of users.

[0021] Figure 3E is a block diagram illustrating the result of a process by which a client computer decrypts received data.

[0022] Figure 3F is a block diagram illustrating aspects of a client computer encrypting update data using a key combination including a vault key for a user's group.

[0023] Figure 3G is a block diagram illustrating a client computer providing update data to a server for storage.

[0024] Figure 3His a block diagram illustrating a verification process for determining whether a user is a member of a group.

[0025] Fig. 3I is a block diagram illustrating the result of a server writing data to a vault in response to a user's membership verification.

[0026] Figure 4 is a flow chart illustrating aspects of a process for obtaining a user's private key.

[0027] Figure 5 is a flow diagram illustrating aspects of a process for obtaining a vault key from a vault service.

[0028] Figure 6 is a flow chart illustrating aspects of a process for creating secret data in a personal vault.

[0029] Figure 7 is a flow diagram illustrating aspects of a process for creating secret data in a group vault.

[0030] Figure 8 is a flow diagram illustrating aspects of a process for sharing secret data from a personal vault to a group vault.

[0031] Fig. 9 is a flow chart illustrating aspects of a process for updating secret data stored in a vault.

[0032] Fig.10 is a flow chart illustrating aspects of a process for allowing a user to browse data stored in a vault.

[0033] Fig.11 is a flow chart illustrating aspects of a process for obtaining secret data from a vault service.

[0034] Fig.12 is a flow diagram illustrating aspects of a process for adding a user to a group associated with a vault.

[0035] Fig.13 is a process flow diagram illustrating aspects of a process for storing secret data in a vault and adding a user to a group associated with the vault.

[0036] Fig.14 is a block diagram illustrating aspects of a process for obtaining activity data to control key updates for a group vault storage system.

[0037] Fig.15 is a block diagram illustrating aspects of active data that can be used to control key updates for a group vault storage system.

[0038] Fig.16A is a block diagram illustrating aspects of a process for controlling key updates to be executed by multiple client computing devices.

[0039] Fig. 16B is a block diagram illustrating aspects of a process for receiving data encrypted using an updated key.

[0040] Fig.17A Aspects of activity data having a first set of characteristics that enables a computing device to control updates of one or more keys are shown.

[0041] Fig. 17B Aspects of activity data having a second set of characteristics that enables a computing device to control updates to one or more keys are shown.

[0042] Fig. 17C Aspects of activity data with other characteristics that enable a computing device to control updates to one or more keys are shown.

[0043] Fig.18 is a process flow diagram illustrating aspects of a process for updating one or more encryption keys based on activity of a group of users.

[0044] Fig.19A is a block diagram illustrating aspects of a process for managing user permissions on a storage system based on membership data provided by a group management system.

[0045] Fig.19B Aspects of a process of adding a second user to a group are shown.

[0046] Fig.19C Aspects of the process of transferring membership data from a group manager to a storage server are shown.

[0047] Fig.19D Aspects of a process of sending update commands from a stored server to a client computer are shown.

[0048] Fig.19E Aspects of a process of transferring encryption keys from a client computer to a server and / or a new group member's client computer are shown.

[0049] Fig.19F Aspects of the process by which a new member of a group can store communication encrypted data to a server are shown.

[0050] Figure 19G Aspects of a process are shown by which a new member of a group can store encrypted data on a server based on membership data received from a group manager.

[0051] Fig. 20 is a process flow diagram illustrating aspects of a process for updating permissions for a user based on membership of a group.

[0052] Fig.21 is a computer architecture diagram that illustrates an illustrative computer hardware and software architecture for a computing system capable of implementing various aspects of the techniques and technologies presented herein.

[0053] Fig. 22 is a diagram illustrating a distributed computing environment in which aspects of the techniques and technologies presented herein can be implemented.

[0054] Fig.23 is a computer architecture diagram illustrating a computing device architecture of a computing device capable of implementing various aspects of the techniques and technologies presented herein. DETAILED DESCRIPTION

[0055] The following detailed description is directed to techniques for providing enhanced security for encrypted data. In some configurations, a system is able to provide enhanced security for secret data shared by a group of users by using a single vault key associated with an individual group of users. As users dynamically join or leave a group, such as a chat session, group conference, channel, or other form of communication session, the system is able to utilize individual vault keys to control access to secure data shared by the group. For example, a system may associate a vault key for each channel created within a user group collaboration application, such as MS Teams or Slack. The vault keys can be used in a series of encryption steps that can allow a storage system to effectively control access to shared data for user groups with high churn rates. As will be described in more detail below, the use of vault keys associated with user groups alleviates the administrative overhead conventionally required to manage access rights to protected data. Additional details of a storage system utilizing vault keys are described below, and in conjunction with Figure 1-13 Additional details of the management tools for adding users to groups are described below and are discussed in conjunction with Figures 19A-20 is shown in the described example.

[0056] The system can also provide enhanced security for encrypted data by using encryption key updates based on user group activity. Embodiments disclosed herein utilize a combination of vault keys and other security keys to control access to secret data shared by members of a group. The vault keys allow the system to control access to secret data by users who join a particular group, while immediately restricting access from users who leave the group. Updates to the keys are initiated based on the activity of members of the group, which can include, but are not limited to: a threshold change in the number of group members, the total number of group members, the amount of data shared between group members, and / or the age of one or more keys used to protect data shared by the group. Additional details regarding key updates are described below and in conjunction with Figure 14-18 The examples described are shown in FIG.

[0057] Although the subject matter described in this article is presented in the general context of program modules that operate in conjunction with the operation of an operating system and application programs on a computer system, those skilled in the art will recognize that other implementations can be performed in conjunction with other types of program modules and / or other types of devices. Typically, program modules include routines, programs, components, data structures, and other types of structures that perform specific tasks or implement specific abstract data types. In addition, those skilled in the art will recognize that the subject matter described in this article can be practiced using other computer system configurations, including handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, etc.

[0058] In the following detailed description, reference is made to the accompanying drawings which form a part hereof and in which are shown by way of illustration of specific configurations or examples. Referring now to the drawings, wherein like numerals represent like elements throughout the several figures, aspects of a computing system, a computer-readable storage medium, and a computer-implemented method for providing enhanced security for encrypted data.

[0059] Figure 1A system 100 is illustrated that can be used to implement the techniques disclosed herein. The system 100 can include a group manager 115, a server 120, and N client devices 110. The server 120 can communicate with the client devices 110 (individually referred to as 110A-110N), each of which can be operated by a corresponding user 107 (individually referred to as 107A-107N). The server 120 can manage one or more services for storing secret data received from the client devices 110. The secret data can be stored in association with a vault 109, which can include encrypted secret data 101', an encrypted secret key 102', and an encrypted vault key 104'. The vault 109 can be associated with a user group 111 having a group identifier 112 and a user identity list 113 for each member of the group 111.

[0060] The server 120 can also communicate with a group manager 115, which is configured to manage collaborative sessions for individual groups 111 of users 107. For example, the group manager 115 (also referred to herein as a "group management system 115") can manage communications between users of a group that is participating in a chat session, channel, meeting, conference call, or any other collaborative data exchange. Examples of features of the group manager can include features provided by Slack, Google Hangouts, or Microsoft Teams. Examples of entities that can provide features of the system 100 can include Amazon, Oracle, Salesforce, or Facebook. In some configurations, the group manager 115 can maintain a group roster 116 that identifies each group using a group identifier 112 and the identity 113 of each group member. Users can be added to or removed from a group 111 by members of the group. In some configurations, some users can also independently control to add themselves to or remove themselves from a group. The server 120 can send a verification request 121 to the group manager 115, and in response to the request, the group manager 115 can send a confirmation 122 to the server 120 to verify whether the particular user 107 or group of people is part of the group 111. The group manager 115 can also send the roster data to the server 120 without a request from the server 120.

[0061] The system 100 enables users of a group to share secret data with other members of the group. Access to the secret data stored on the server 120 is based on the user's membership status in a particular group associated with the secret data. Thus, when a user joins a particular group, the group members can gain access to the secret data stored in association with the group, such as read and / or write permissions. When a user leaves the group, the server 120 can communicate with the group manager 115 to verify the status of each member. Upon verifying that a user has left the group, the server 120 can restrict access and prevent the user from accessing, for example, reading and / or writing, the secret data stored on the server 120 in association with the group.

[0062] In order to store secret data in the vault 109, each group member can encrypt the secret data 101 using the secret key 102 on the client device 110 to generate encrypted data 101'. In some configurations, the secret key 102 can include a symmetric key. Each group member can also encrypt the secret key 102 using the vault key 104 to generate an encrypted secret key 102'. In addition, each group member can also encrypt the vault key 104 using the public key from the public key-private key pair to generate an encrypted vault key 104'. Then, each user can transmit their respective encrypted data 101', encrypted secret key 102' and encrypted vault key 104' to the server 120 for storage in the vault 109. When the user wishes to retrieve the stored data, each user can decrypt the encrypted vault key 104' by using the corresponding private key of its public key-private key pair to obtain the vault key 104. Each user can then utilize the vault key 104 to access the secret key 102 and ultimately the secret data 101 .

[0063] For illustrative purposes, a "vault" can include a data store dedicated to storing information shared by a specific group of users. Access to the vault is based on a member roster that can be verified by a reliable resource such as a group manager 115. Access to the vault can be granted to multiple users currently participating in the group. The group administrator can grant permissions by transmitting the identity of each user to a system (such as Google Drive, OneDrive, iCloud, etc.) that manages the vault. The vault can be constructed as an autonomous data store independent of other vaults. Therefore, a user who is a member of a group with access to a first vault is not granted access to read data from or write data to a second vault associated with another group. The data stored in each vault can include encrypted secret data and encrypted security keys. In some configurations, the vault key 104 can be generated by a server 120 and transmitted to each client device associated with a member of a specific group. In other configurations, the client device 110 can be used to generate the vault key 104.

[0064] In some configurations, the techniques disclosed herein can separate user authentication and access control into two distinct processes, and each process can be performed by two entities. For example, access to the data in the vault can be managed by a first entity, such as Google Drive, Amazon Web Services (AWS), Oracle Cloud, Salesforce Service Cloud, Facebook Cloud, etc. The group vault service has a dependency and can benefit from such a trusted authentication service and trust the verification from the authentication service regarding the requesting member's access to the vault. The process of determining whether people are current members of the group can be managed by a second entity, such as Slack, Microsoft Teams, etc.

[0065] Reference now Figures 2A to 2G , various aspects of the process of storing encrypted data using a vault key for a group of users are shown and described below. In this example, each user is a member of a group 111 associated with a vault 109. Figure 2AAn example of a user utilizing corresponding client devices 110A-110N to generate encrypted data is illustrated. For example, a first user 107A utilizes a first client device 110A to encrypt secret data 1101A using secret key 1102A to generate encrypted data 1101A'. The first client device 110A is capable of encrypting secret key 1102A using a vault key 104 associated with a group 111, thereby generating an encrypted secret key 1102A'. Additionally, the first client device 110A is capable of encrypting vault key 104 using a public key 1105A from a first public key-private key pair associated with the first user to generate an encrypted vault key 1104A'. Other client devices 110B-110N associated with other users 107B-107N can utilize similar processes to generate other encrypted data, such as encrypted data 2 101B', encrypted secret key 2 102B', encrypted vault key 2 104B', encrypted data N 101N', encrypted secret key N 102N', and encrypted vault key N 104N', using their respective public-private key pairs. The encrypted data can then be transmitted to the server 120 for storage in the vault 109.

[0066] As in Figure 2B As shown in , in response to receiving the encrypted data, or in response to receiving a request (also referred to herein as a "write request") to store the encrypted data in a vault 109 associated with a group 111, the server 120 determines whether each user requesting to store the encrypted data is a member of the group 111. In one illustrative example, the server 120 can send a verification request 121 to the group manager 115 to verify the membership status of each requesting user. In response to the verification request 121, the group manager 115 can access records, such as a group roster 116 that defines the members of each group, to determine whether one or more users are current members of the group. Individual records can indicate a group ID 112 and a user ID 113 for each member. Individual records can also indicate specific permissions and roles for each user ID. Therefore, in response to the verification request 121, the group manager 115 can respond by sending a confirmation 122 back to the server 120. In this example, the confirmation 122 indicates that the first user 107A (User 1) is still a member of the group (Group 1), the second user (User 2) is still a member of the group (Group 1), and the Nth user (User N) is still a member of the group (Group 1).

[0067] The verification request 121 can be in a variety of different forms. In one example, the verification request 121 can include the group ID 112. In response to such a request, the group manager 115 can send a confirmation 122 including a list of all members of the group. In another example, the verification request 121 can include the group ID 112 with multiple user IDs 113. In response to such a request, the group manager 115 can send a confirmation 122 including the specific user ID 113 indicated in the request 121, with an indication of their membership status, such as currently a member, not a member, not a member as of a specific date and time, etc.

[0068] In yet another example, the verification request 121 can include a group ID 112, a plurality of user IDs 113, and other metadata indicating a request for verification of one or more permissions. In response to such a request, the group manager 115 can send a confirmation 122, which includes the group ID, the specific user ID 113 of the current member, and one or more permissions associated with each user ID 113. The permissions can indicate the access level or role for each user, such as administrator permissions versus regular user permissions. The permissions can also indicate specific access permissions, such as read and / or write permissions. In other embodiments, the permissions can also indicate specific access permissions applicable to individual files or file groups, such as read and / or write permissions. Based on the permissions defined in the confirmation 122, the server 120 can determine whether each user can write data to the vault 109.

[0069] As in Figure 2C As shown in , for each individual who is a member of the group associated with the vault, the server 120 can store the received encrypted data in the vault 109 in association with a particular group 111, e.g., each user is part of a chat session or channel managed by a group manager 115. In some configurations, the server 120 can associate the vault 109 with a group ID 112, and the server 120 can associate the group ID 112 with individual user IDs 113A-113N for each member of the group 111. Users who are not current members of the group (e.g., no longer part of a chat session or channel) are restricted from writing data to the vault. Thus, in Figure 2BIn the example shown in , if confirmation 122 indicates that user 2 is not part of group 111, the server will deny user 2 from storing data in vault 109. Therefore, in such an example, server 120 will not store encrypted data 2 101B', encrypted secret key 2 102B', encrypted vault key 2 104B' in the vault in response to determining that user 2 is not part of group 111.

[0070] Once the encrypted data is stored in the vault, any current member of the group can access the encrypted data stored in the vault. Figure 2D Various aspects of a process by which a user requests access to encrypted data stored in a vault for a particular user group 111 are shown. In this example, to illustrate various aspects of how data can be shared between group members, a first user 107A sends an access request 124 to request a copy of encrypted data 2 102B', e.g., secret data originally stored by a second user 107B using a second computing device 110B. At the same time, in this example, the second user 107B sends an access request 124 to request a copy of encrypted data 1 102A', e.g., secret data originally stored by the first user 107A using the first computing device 110A. Likewise, in this example, a user 107N sends an access request 124 to request a copy of encrypted data N 102N', e.g., secret data that the user originally stored at a server 120.

[0071] In response to the access request 124, as in Figure 2E , the server 120 can determine whether each requesting user is still a member of the group. In an illustrative example, the server 120 can send a verification request 121 to the group manager 115 to verify the membership status of each requesting user. In response to the verification request 121, the group manager 115 can access records, such as a group roster 116 that defines the members of each group. Individual records can indicate the group ID 112 and user ID for each member. Individual records can also indicate specific permissions and roles for each user ID. Therefore, in response to the verification request 121, the group manager 115 can respond by sending a confirmation 122 back to the server 120. In this example, the confirmation 122 indicates that the first user 107A (user 1) is still a member of the group (group 1), the second user (user 2) is still a member of the group (group 1), and the Nth user (user N) is still a member of the group.

[0072] refer to Figure 2F, since the confirmation 122 indicates that each of the requesting users is a current member of the group, the server 120 transmits the requested data to each client device 110. Specifically, the server 120 transmits the encrypted vault key 1 104A', the encrypted data 2 101B', and the encrypted secret key 2 102B' to the first client device 110A. The server 120 also transmits the encrypted vault key 2 104B', the encrypted data 1 101A', and the encrypted secret key 1 102A' to the second client device 110B, and transmits the encrypted vault key N 104N', the encrypted data N 101N', and the encrypted secret key N 102N' to the Nth client device 110N. As shown, in response to an access request, each requesting user receives the encrypted data 101 ′ and encrypted secret key 102 ′ that it requested, as well as the encrypted vault key 104 ′ associated with its public-private key pair that was used to encrypt the vault key 104 .

[0073] As in Figure 2G As shown in , each client device 110 is able to decrypt the received data using the private key 106 corresponding to the public key used by each user to encrypt the vault key 104. Specifically, the first user 107A uses the first client device 110A to decrypt the encrypted vault key 1 104A' using the first user's private key (user 1 private key 106A) to generate the vault key 104. Then, the first client device 110A is able to use the vault key 104 to decrypt the encrypted secret key 2 102B' to generate the secret key 2 102B. Then, the first client device 110A is able to use the secret key 2 102B to decrypt the encrypted data 2 101B' to generate the encrypted data 2 101B. Other client devices 110B-110N associated with other users 107B-107N can decrypt other received data in a similar manner. As shown, the system 100 allows members of a group to share and retrieve secret data when they are members of the group.

[0074] Reference now Figures 3A-3G , another user scenario is shown and described below. This example illustrates how the system 100 can be used to restrict access to members who are not or are no longer part of a group. Likewise, this example shows how the system 100 can be used to allow users to update stored data. Figure 3A As shown in , it is assumed that each client device 110 starts with a private key 106 before sending an access request.

[0075] Figure 3B102A', e.g., the secret data originally stored by the second user 107B using the second computing device 110B. The second user 107B sends the access request 124 to request a copy of the encrypted data 1 102A', e.g., the secret data originally stored by the first user 107A using the first computing device 110A. Likewise, similar to the previous example, the user 107N sends the access request 124 to request a copy of the encrypted data N 102N', e.g., the secret data originally stored by the user at the server 120.

[0076] In response to access request 124, as in Figure 3C , the server 120 determines whether each requesting user is a member of the group by using a verification request 121. In this example, the second user 107B has been deleted from the group's roster, as indicated by data stored at the group manager 115. Therefore, in response to the verification request 121, the group manager 115 responds by sending a confirmation 122 back to the server 120, which indicates that the first user 107A (User 1) and the Nth user (User N) are still members of the group (Group 1), while the second user (User 2) is no longer a member of the group (Group 1).

[0077] As in Figure 3D As shown in , the server 120 responds to the confirmation 122 by allowing communication of the encrypted data to be sent to the first user 107A and the Nth user 107N, while restricting access to the second user 107B. In such an embodiment, the server 120 can send a notification to a client such as the second client 110B, wherein the notification can indicate the status of the access request. The notification can indicate the user status of the group, or provide a message indicating that the requested data is not available. As shown in Figure 3E As shown in , the client devices of the first user 107A and the Nth user 107N are then able to utilize the corresponding private keys 106 to decrypt the received data using the techniques disclosed herein.

[0078] As outlined herein, the techniques disclosed herein allow a user to update encrypted data stored in a vault. Figure 3F-3I Various aspects of this process are shown in Figure 3FAs shown in , the Nth client device 110N can generate updated data 141N. The Nth client device 110N can then encrypt the updated data 141N using the secret key 102N, and then encrypt the secret key 102N using the vault key 104. The vault key can then be encrypted using the user's public key 105N. As shown in Figure 3G As shown in , the Nth device 110N can then transmit the updated encrypted data 141N' to the server 120. In response to receiving the encrypted data, as shown in Figure 3H As shown in , the server 120 can verify the membership status of the user with respect to the group. In this example, the group manager 115 confirms that the user is currently a member of the group. In response to the confirmation, as in Fig. 3I As shown in , the server 120 stores the updated encrypted data 141N' in the vault 109. If the confirmation from the group manager 115 indicates that the Nth user 107N is not a current member of the group, or if the Nth user 107N has restricted write permissions, the server 120 can deny any request from the user to write data to the vault 109.

[0079] exist Figure 3F-3I In an example of , the user can also provide updated encrypted secret data encrypted using the new secret key. In such an embodiment, the client device will also provide an updated encrypted secret key encrypted using the vault key. In addition, the user can also provide an updated encrypted vault key encrypted using the new public key from the new key pair. This encrypted data provided by the client can be stored in the vault after verifying the user's membership in the group or after verification from the group administrator that the user has write permission to the vault.

[0080] In the examples provided herein, it can be appreciated that encrypted vault keys (including also encrypted vault keys updated with new public keys) can be generated at the server 120. In such an embodiment, instead of transmitting the encrypted vault key from the client to the server, the client can transmit the public key to the server 120 and allow the server 120 or another computer to generate an encrypted vault key using any received public key.

[0081] Figure 4The process for obtaining the user's private key is illustrated. At login, a client 110, which may be operated by a user 107 such as a first user 107A, can attempt to obtain the private key from a resource such as an OS secure storage device 130. If this is the first use of the client 110 or if the private key has been removed from the OS secure storage device 130, the client 110 can obtain the user's private key from a key directory service 140. The key directory service can include a data store of secure keys that can be accessed by users with appropriate certificates. If the key directory service 140 does not have a key bundle, an error is returned to the client 110. The error indicates that this is the first login for the user 107. Therefore, the task of the client 110 is to generate a public / private key pair and upload it. If the client 110 only uploads the public key, the system will have to find a way to share the private key between each client that the user logs in. In some configurations, the system can encrypt the private key using a symmetric key, which is much smaller in size and obtains equal security. The client 110 can also encrypt the private key and send it to the remote computer, and then, when the client uses it for the first time, only share the client key, such as a 128-bit symmetrically encrypted key, between the clients. As in other descriptions herein, any encrypted data is noted by using a prime, e.g., vault key 104', indicating an encrypted vault key.

[0082] If a private key exists in directory service 140, it is downloaded to client 110 and the system can attempt to obtain the client key from OS secure storage 130. If the client key does not exist, client 110 can prompt the user to provide one, as this is not the first usage scenario but simply preparing the client application for the first time.

[0083] With regard to the storage of a user's private key, a variety of different techniques can be used to manage the storage. As described above, in some configurations, the private key can be stored in a key directory service. However, when a user wishes to use multiple devices to access their stored secrets, the user can encrypt the private key and then share the private key with other devices. As outlined in this article, the user must have a private key to correctly decrypt the secrets received from the vault. However, in order to access the private key, it needs to be shared between devices belonging to a single user. To this end, one of the client devices in the user device can encrypt the private key using a symmetric key (e.g., AES-128), and upload the encrypted private key to the key directory service so that the size of the data that needs to be shared between devices (only 128 bits) is significantly smaller than the private key.

[0084] The symmetric key can be saved to the operating system (OS) secure storage and retrieved only when needed for transfer to a new device. When provisioning a new client, the private key can be retrieved from the key directory service and then saved to the OS secure storage for future use.

[0085] Transmitting a client key (such as a 128-bit shared client key) can be a one-time event for each new client. There are several embodiments for transmitting the client key. For example, when both the prepared device and the new device are connected to the Internet, the user can initiate a secure transmission process between the devices using conventional secure message transmission methods, wherein each device creates its own public and private key pair. In another embodiment, the user can create a quick response (QR) code and display it on one device for the new device to capture and register. In another embodiment, the device can display a string that the user types into another device. The user can also print the string and save it in a safe place so that the user does not need to access the old device.

[0086] In some embodiments, the client computer 110 can perform a process for sharing a single key with multiple devices for a single user. The client computer 110 can use a symmetric key to encrypt a private key of a private key-public key pair to generate an encrypted private key. The client computer can then transmit the symmetric key in a security service running on a remote device, wherein the security service provides access to the symmetric key by using one or more certificates associated with the first user. The process can also include transmitting the encrypted private key to a secure storage device 130 associated with an operating system of one or more computing devices, wherein the encrypted private key is protected using one or more certificates associated with the first user. The one or more computing devices can include the client device 110, the server 120, or another computer accessible by the first user. It can be appreciated that the client operating system secure storage device 130, the key service 140, and / or the client security service 131 can reside on any suitable computing device, including but not limited to: the client device 110, the server 120, or any other remote device accessible to a user (such as the first user 107A).

[0087] Figure 5The process for obtaining a vault key for a specific vault is illustrated. When a vault key is requested, a vault service (e.g., server 120) will return a vault key encrypted with a user's public token. In some configurations, a user's token is an access token obtained by a client when a user logs in with its certificate, which may include a Microsoft account (MSA) or an Azure Active Directory account (AAD) certificate. The token contains the user's ID and can be trusted to indicate that the user agrees to take action when verified. If a vault has not yet been prepared, the vault service 129 can return an error and the vault SDK can generate a key, such as an AES-256 key, and encrypt it for each member of the group. Timing can affect the process. For example, when a client 110 requests to create a vault, a vault service (e.g., server 120) can create a vault, or if another client has created a vault, the server will return an encrypted vault key for the requester.

[0088] This example is provided for illustrative purposes and should not be construed as limiting. It can be appreciated that each system (including the server 120 or the group manager 115 (e.g., the chat service 115)) can utilize one or more techniques to authenticate users on each system, for example, each system can use a different authentication service and / or different certificates for each user. In some configurations, the server 120 can utilize an authentication process independent of the group manager 115. Alternatively, the server 120 can utilize an authentication process coordinated with the group manager 115, for example, each system can use the same authentication service or certificates for each user. In some configurations, the group manager may not utilize certificates for certain group members, particularly in configurations where users can join a group anonymously.

[0089] For the purpose of illustration, a personal vault can simply include a group with a single member, and share the remaining logical units and selected parts of the data. The vault ID for a personal vault is a user ID, while the vault ID for a group vault can be a thread ID for a group communication session. When the vault is not yet prepared, the client 110 can poll a group manager 115 (e.g., a chat service) to request a membership roster in the case of a group, or set the membership roster to the ID of the current user in the case of a personal vault. In either case, the client 110 can then traverse the membership roster and encrypt the vault key using the public key of each member. Then, a tuple set of user ID, vault ID, and encrypted vault key (encrypted vault key ') is sent to a vault service 120 to create a vault. If the vault still does not exist, the vault service 120 can store the data in a storage resource associated with the user, such as a personal storage device or service. In the following figure, when a request is made for a vault key, it can be assumed that the vault has been prepared for illustration purposes.

[0090] Figure 6 The process for creating a secret in a personal vault is illustrated. In this example, the secret is encrypted using symmetric encryption (such as AES-256), and the encrypted secret is the content that is persistently stored in a storage device (such as a vault service 120). In some configurations, each secret can have its own unique secret key. The secret key may not be retained on the client 110, but is encrypted using the vault key, and the user only needs to use its public key to access the encrypted vault key to be able to read the chain all the way back to the secret. In this way, the personal vault is no different from the group vault. In this example, if the secret is less than a predetermined threshold, such as two megabytes, the vault service 120 can transmit the secret ID and the secret metadata to the first resource for the secret 151. If the secret is higher than the threshold, or the secret cannot fit the database, the vault service 120 can transmit the secret ID and the encrypted secret to the second resource for the big secret 152. In some configurations, the vault service 120 can transmit the vault ID, secret ID, and encrypted secret key (encrypted secret key') to a third resource (vault(s) 153).

[0091] Figure 7The process of creating a secret in a group vault is illustrated. This example involves a first user 107A (Annika) who wants to share a secret (e.g., secret data) with a second user 107B (Bo). When Annika wants to share a secret with Bo, she encrypts the secret using a secret key, which can be a 256-bit secret key, to generate an encrypted secret. Annika also encrypts the secret key using a vault key for her shared vault and sends the encrypted secret and the encrypted secret key to the vault service 120. Figure 6 The difference between this example and the example of is that the vault key is sent in association with the group's thread ID rather than the user ID.

[0092] Figure 8 The process for sharing secrets from a personal vault to a group vault is illustrated. Generally speaking, there are almost no restrictions when sharing secrets between vaults. In some configurations, secrets can be shared from a personal vault to a group vault. Sharing secrets from a personal vault to a group vault involves adding additional records in the vault storage, but this requires a secret key. Since the server may not store unencrypted keys, the client computer 110 can use the private key of his or her personal vault to open the encrypted secret key, and then re-encrypt it using the key of the group vault. At the client 110, a secret ID and a source vault ID and a destination vault ID can be obtained. Such information can be provided by the user 107 or any other computing resource. Then, the data is shared with the vault service 120 that verifies the user token. The verification process can involve sending a query to the group manager, such as a chat service, and receiving a verification indicating that the user is a member of a specific group from the group manager. The server 120 can return an encrypted source vault key, an encrypted secret key for the source vault, and an encrypted destination vault key encrypted using the public key of the user 107. Client 110 may request a private key from client OS secure storage 130 .

[0093] The client 110 can then use the private key to decrypt the source vault key, use the source vault key to decrypt the secret key for the source, and use the destination vault key to encrypt the secret key. The client 110 can then share the secret with the vault service 120 by sharing the destination vault ID, secret ID, and the encrypted secret key for the destination vault ("secret key' destination"). The vault service 120 can then add the secret ID, secret key' destination entry to the vault for the destination vault ID.

[0094] Fig. 9The process for updating a secret is illustrated. In some configurations, a user can only update secrets that they own. A user owns a secret if they are a member of a group identified by a thread ID that owns a vault for a shared vault, or if the secret is in their personal vault. In such embodiments, both the client 110 and the server 120 can be configured to enforce this constraint.

[0095] When Annika wants to change the contents of a secret she has, she simply replaces the secret with a new one encrypted with the same secret key. In order to obtain the key used to encrypt the new secret, she must follow a process to retrieve the secret. Since the changes are limited to the actual payload, there is no need to update Bo's encrypted secret key.

[0096] Fig.10 An exemplary process for allowing a user to browse a vault is illustrated. In general, a client 110 can receive updates to secret metadata by requesting all secret metadata changes since a given timestamp. The timestamp can come from the last time the vault service received data, for example, the last observed time. In response to the request, the vault service 120 can traverse each vault secret in the user's vault and vault secrets. The vault service 120 can then return secret metadata and a secret ID for each secret. The return value returns the current timestamp, which can then be stored and used the next time a request is made. Sorting or filtering the secrets can be performed by the client 110. In some embodiments, the client 110 can use filters by type or by vault. The secret metadata can provide a summary of the secret data, the owner of the secret data, a description of the owner of the secret data, etc.

[0097] Fig.11 An exemplary process for obtaining a secret is illustrated. In general, when a user has identified a secret of interest by reading metadata, the secret can be requested from a vault service. In some embodiments, the metadata can include a summary of the secret, an associated key, or any other information related to or indicative of the secret. In some embodiments, the metadata can include a timestamp, a description of the user's activity, etc.

[0098] exist Fig.11The process illustrated in the figure can include an operation for receiving a secret ID to be updated and an identifier (e.g., a vault ID) of a vault containing the secret. The secret ID and the vault ID can be transmitted to the vault service 120 within the request. In response, the vault service 120 verifies that the user is a member of the group. The process may involve communication with a group manager (such as Slack, MS Teams, etc.). The vault service 120 can respond to the request by delivering an encrypted vault key and an encrypted secret key that can be encrypted using the user's public key. In some configurations, the client 110 can send a request to the client OS secure storage device 130 to request a permanently stored private key. In response to receiving the private key, the client 110 can use the user's private key to decrypt the encrypted vault key, and use the vault key to decrypt the encrypted key. The system can also use the secret key to decrypt the encrypted secret, thereby generating the secret data.

[0099] Fig.12 The process for allowing a user to add someone from a directory to a group is illustrated. When a user adds a new member to a group, the new member will need the vault key encrypted with their public token to be able to decrypt the secret. The vault service has no data about the vault key, so the vault service cannot automatically provide the key for the new member. The user who is adding the new member can obtain the vault key, so as part of adding the new member to the group, one or more clients 110 can also add the new member to the vault.

[0100] The process begins when the client requests a private key for a specific user (such as the first user). The client 110 can find the second user in the directory and obtain the user ID of the second user. The client 110 can also obtain the vault ID and encrypt one or more secrets using a secret key. The client 110 can send a request to the vault service 120 to obtain an encrypted vault key, which can be encrypted using the first user public key. The public key for a new user (e.g., the second user) can be obtained by the client through one or more resources such as key services 140. Then, the client 110 can use the private key of the first user to decrypt the encrypted vault key. The client 110 can then use the public key of the second user to encrypt the vault key. The client 110 can then transmit the encrypted vault key encrypted by the second user public key to the vault service 120. In such communication, the client 110 can also transmit the vault ID, the user ID of the second user and the encrypted vault key. In response, the vault service 120 can add an entry to the user table.

[0101] Now turn to Fig.13 , various aspects of a routine 900 for providing enhanced security for encrypted data are shown and described below. It should be understood that the operations of the methods disclosed herein are not necessarily presented in any particular order, and it is possible and contemplated to perform some or all of the operations in (one or more) alternative orders. For ease of description and illustration, the operations have been presented in the order in which they are presented. Operations may be added, omitted, and / or performed simultaneously without departing from the scope of the appended claims.

[0102] It should also be understood that the illustrated method can be terminated at any time and need not be executed in its entirety. Some or all of the operations of the method and / or substantially equivalent operations can be performed by running computer-readable instructions contained on a computer storage medium, as defined below. As used in the specification and claims, the term "computer-readable instructions" and its variants are used broadly herein to include routines, applications, application modules, program modules, programs, components, data structures, algorithms, and the like. Computer-readable instructions can be implemented on a variety of system configurations, including single-processor or multi-processor systems, minicomputers, mainframe computers, personal computers, handheld computing devices, microprocessor-based programmable consumer electronics, combinations thereof, and the like.

[0103] Therefore, it should be appreciated that the logical operations described herein are implemented as: (1) a sequence of computer-implemented actions or program modules running on a computing system, and / or (2) interconnected machine logic circuits or circuit modules within the computing system. The implementation is a matter of choice depending on the performance and other requirements of the computing system. Therefore, the logical operations described herein are variously referred to as states, operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules may be implemented in software, firmware, dedicated digital logic, and any combination thereof.

[0104] As will be described in more detail below in conjunction with other figures, the operation of routine 900 is described herein as being implemented at least in part by an application such as program module 623 of FIG. 19 , which is also referred to herein as one or more program modules. Although the following description refers to program module 623, it will be appreciated that the operation of routine 900 or any other process, method, or operation disclosed herein may also be implemented in many other ways. For example, routine 900 may be implemented as part of an operating system or as part of any other application. In addition, it will be appreciated that implementations of system 100 may include Figure 1More or fewer computing devices as shown in . For example, each of the software components and modules described above can be implemented in a single computing device configured with the same features. In other scenarios, some of which may include the use of server farms, any number of computing devices can be used to implement the features and techniques described in this article.

[0105] refer to Fig.13 , the routine 900 begins at operation 901, where the program module 623 receives encrypted secret data 101A' generated from secret data 101A using secret key 102A. In some configurations, the encrypted secret data 101A' is generated on a remote computer such as client device 110 and transmitted to a computer running program module 623, such as server 120.

[0106] At operation 903, the program module 623 receives an encrypted secret key 102A' generated from the secret key 102A using the vault key 104 associated with the group 111 of the user 107. In some configurations, the encrypted secret key 102A' is generated on a remote computer, such as the client device 110, and transmitted to the computer running the program module 623, such as the server 120.

[0107] At operation 905, program module 623 receives encrypted vault key 104' generated from vault key 104 using public key 105A associated with first user 107A of group 111 of users 107. In some configurations, encrypted vault key 104' is generated on a remote computer, such as client device 110, and transmitted to a computer running program module 623, such as server 120.

[0108] At operation 907, the program module 623 sends a verification request to the group manager 115 to verify whether one or more users are current members of the group 111. In some configurations, the verification request can include a group ID and at least one user ID, such as the first user 107A. The verification request can be sent to the group manager 115, which manages services such as Slack, Google Hangouts, or Microsoft Teams.

[0109] Next, at operation 909, the program module 623 receives a confirmation from the group manager 115 indicating the membership status of one or more users. In one illustrative example, the confirmation can include a group ID and the membership status of at least one user ID, for example, the first user 107A is a current member, or the first user 107A is not a current member. The confirmation can also include one or more permissions for each user. For example, the confirmation (also referred to herein as the group confirmation 122) can include a user ID and indicate whether the user ID is associated with read and / or write permissions. The confirmation can also describe the role or other attributes associated with the individual user ID. In one illustrative example, reference is made to Figure 1 , the computing device can receive a group confirmation 122 from the group management system 115 , and the group confirmation 122 can indicate the status of the first user 107 and the one or more group identifiers 112 .

[0110] Next, at operation 911, in response to receiving a group confirmation 112 indicating that a user, such as the first user 107A, is associated with a particular group, the routine 900 proceeds to operation 913, wherein the program module 623 is able to take a number of actions to allow the transfer and / or storage of the encrypted data, e.g., the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104'. However, if the group confirmation 112 indicates that the user, such as the first user 107A, is not associated with the particular group, the routine 900 proceeds to operation 914, wherein the program module 623 is able to take a number of actions to restrict the transfer and / or storage of the encrypted data, e.g., the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104'.

[0111] Reference now Figure 14-18 , techniques for controlling updates to encryption keys of the system 100 are shown and described in more detail below. In general, an update to one or more encryption keys is invoked when a particular type of activity with respect to a group of users meets one or more criteria. For example, when the size of the group of users exceeds or drops below one or more thresholds, the system 100 can cause one or more client computers to update to one or more keys. When a churn rate exceeds or drops below one or more thresholds, the system 100 can cause one or more client computers to update to one or more keys. When the system detects that one or more keys exceed an age threshold, the system 100 can cause one or more client computers to update to one or more keys. When stored data or data usage exceeds or drops below one or more thresholds, the system 100 can cause one or more client computers to update to one or more keys. For illustrative purposes, Figures 14 to 18Aspects of a process for managing updates to one or more encryption keys based on user activity of a group vault storage system are shown.

[0112] As in Fig.14 , the group manager 115 can maintain a membership roster 901 that lists the identities 113 of the members of the user group 111. Individual membership rosters 901 can list users participating in a communication session, such as a channel, a chat session, a meeting, or any other collaborative group activity for exchanging information. Users can be added or removed from a particular roster by joining or leaving a group (such as a channel, a meeting, etc.). In some configurations, the group manager 115 can transmit instances of the membership roster 901, or updates the membership roster 901 to the server 120. Over time, the server 120 can collect and analyze multiple membership rosters 901 to detect the presence of one or more predetermined patterns of user activity.

[0113] As in Fig.15 As shown in , the server 120 can generate activity data 902 based on the analysis of one or more membership rosters 901 received over time to determine a variety of different types of performance metrics. The performance metrics can include user churn measurements, such as the number of users who have joined or left the group, the total number of group members, fluctuations in the churn rate, etc. The server 120 can also measure data usage parameters for individual groups, such as the amount of data shared by the group, fluctuations in the amount of data shared by the group, etc. In addition, the server 120 can measure different parameters relative to the age of one or more encryption keys associated with the vault or group of users, such as the age of the vault key, the age of the secret key, and / or the age of the public and private key pairs. It is also possible to measure a combination of performance metrics, such as the amount of data shared by the group and the age of a specific key, the amount of user churn measured for the group and the age of a specific key, the amount of data shared by the group and the number of users who have joined or left the group, etc.

[0114] exist Fig.15 In the example of , when one or more measurements are below one or more thresholds, such as churn threshold 903, data activity threshold 905, and / or key age threshold 906, the system can continue to monitor activity data 902 without sending any update commands for updating one or more keys at client device 110. However, as in Fig.16A As shown in , when one or more of the measurement results exceed the one or more thresholds, the server 120 may transmit one or more update commands 1310 to the client device 110. In response to the update command 1310, as in Fig. 16B, the client device 110 can replace any existing key or any combination of existing keys with a new key. For example, the update command 1310 can cause the client device 110 to update a secret key and / or a private key-public key pair. In some configurations, a vault key for a particular group can be generated at the server 120 and transmitted to the client device 110. In some configurations, a vault key can be generated at the client device 110 in response to receiving the update command 1310. In such an embodiment, one client device can generate a vault key, and other devices will receive a copy of the newly generated vault key via the server 120.

[0115] In some configurations, a single client device or a selected group of client devices can be selected to update one or more keys. The selection of the device for updating one or more keys can be based on the role or permission for each member, the activity of a specific client device and / or the hardware capabilities of a specific client device. For example, if the user is a designated administrator for a group, the user and / or the corresponding device of the user can be selected to update one or more keys. In some configurations, the client devices can communicate with each other and / or communicate with the server on a peer-to-peer basis to determine which device will update one or more keys. The device can be selected based on the activity of the device and / or one or more capabilities of the individual device. For example, if it is determined that a specific computing device remains online within a period of time relative to other devices in a device pool, the specific computing device can be selected to update one or more keys. In another example, if it is determined that a specific computing device has a more efficient architecture in updating one or more keys or encrypting data, for example, a desktop with a specific processor is compared with a mobile device with a low-power processor, the specific computing device can be selected in other candidate device pools.

[0116] exist Fig. 16BIn the example shown in , update command 1310 causes each client device to update all keys for each client device. For illustrative purposes, the figure numbers marked with an asterisk represent new keys, and the figure numbers marked with an apostrophe represent encrypted data. For example, the first device 110A can replace the vault key 104A and the secret key 102A with the new vault key 104A* and the new secret key 102A*. The update command 1310 can also cause the first client device 110A to encrypt the secret data 101A using the new secret key 102A* to generate updated encrypted secret data 101A'*. The update command 1310 can also cause the first client device 110A to encrypt the new secret key 102A* using the new vault key 104A* to generate updated encrypted secret key 102A'*. The update command 1310 can also cause the first client device 110A to encrypt the new vault key 104A* using the new public key 105A* to generate an updated encrypted vault key 104A′*.

[0117] This example is provided for illustrative purposes and should not be construed as limiting. It can be appreciated that any combination of encryption keys can be replaced with new encryption keys, and in some embodiments, the client device can use any existing keys in the foregoing process. For example, the update command 1310 can cause the first client device 110A to encrypt the new vault key 104A* using the existing public key 105A to generate an updated encrypted vault key 104A'*.

[0118] Once the client device 110 generates updated keys and newly encrypted data, e.g., updated encrypted secret data 101A'*, updated encrypted secret key 102A'*, and updated encrypted vault key 104A'*, the new encrypted data can be transmitted to the server 120 for storage in the vault 109 associated with the group identifier 112, and ultimately the plurality of user identities 113 associated with the group 111. The process can also be repeated for each client device 110 associated with the user 107 who is a member of the group 109.

[0119] Figures 17A-17C Several exemplary scenarios are illustrated in which particular patterns of user activity 1302 result in updates to one or more encryption keys of the vault storage system. Fig.17A In the first example shown in , the roster trend shows the number of members leaving the group over time. In this example, multiple measurements are taken over a period of time. When a measurement result (such as the measurement result at the fifth sample) exceeds the threshold 1303, the server 120 can transmit an update command so that one or more client devices update one or more encryption keys for storage on the server 120. Fig.17A In the second example shown in , the roster trend shows the total number of group members over time. In this example, multiple measurements are taken over a period of time. When the measurement result (e.g., the measurement result at the fourth sample) exceeds the threshold 1303, the server 120 can transmit an update command so that one or more client devices update one or more keys for storage on the server 120.

[0120] exist Fig. 17B In the first example shown in , the roster trend shows the number of members joining the group over time. In this example, multiple measurements are taken over a period of time. When one or more measurements (such as the measurements at the second and fifth samples) exceed the threshold 1303, the server 120 can transmit an update command so that one or more client devices update one or more encryption keys for storage on the server 120.

[0121] exist Fig. 17B In the second example shown in , the roster trend shows the rate of change of the membership roster, for example, the derivative of the total number of members of the group over time. In this example, multiple measurements are taken over a period of time. When the measurement exceeds the threshold 1303, for example at time A, or when the measurement drops below the threshold, for example at time C, the server 120 can transmit an update command so that one or more client devices update one or more keys for storage on the server 120.

[0122] These examples are provided for illustrative purposes and should not be construed as limiting. It will be appreciated that other variations of these techniques are applicable to the scope of the present disclosure. For example, although threshold 1303 is shown as being constant over time, it will be appreciated that threshold 1303 can vary over time. Francis, the threshold during peak hours of the system may be lower than the threshold during off-peak hours. In yet another variation, the server can also transmit an update command when the rate of change satisfies one or more conditions. For example, in Fig. 17B At time B in the second graph of FIG. 1 , the system can identify a particular slope or a particular change in slope as a triggering event for an update command to be transmitted to one or more client devices.

[0123] Fig. 17CA plurality of scenarios are illustrated that may cause the server 120 to transmit an update command to a client device. For example, in a first scenario, an update command may be transmitted to a client device in response to determining that a churn measurement exceeds a threshold, a data usage activity measurement does not satisfy a threshold, and a key age does not satisfy a threshold. In a second scenario, an update command may be transmitted to a client device in response to determining that a churn measurement exceeds a threshold, a data usage activity measurement exceeds a threshold, and a key age does not satisfy a threshold. In a third scenario, an update command may be transmitted to a client device in response to determining that a churn measurement exceeds a threshold, a data usage activity measurement exceeds a threshold, and a key age exceeds a threshold. In a fourth scenario, an update command may be transmitted to a client device in response to determining that a churn measurement does not exceed a threshold, a data usage activity measurement exceeds a threshold, and a key age does not reach a threshold. In a fifth scenario, an update command may be transmitted to a client device in response to determining that a churn measurement does not exceed a threshold, a data usage activity measurement exceeds a threshold, and a key age exceeds a threshold. In a sixth scenario, an update command may be transmitted to the client device in response to determining that the churn measurement does not exceed the threshold, the data usage activity measurement does not exceed the threshold, and the key age satisfies the threshold.

[0124] Now turn to Fig.18 , various aspects of a routine 950 for controlling updates to encryption keys are shown and described below. Routine 950 begins at operation 951, where one or more program modules receive activity data indicating changes in the number of members of a group. The activity data can be generated by a computing device such as server 120. Alternatively, the activity data can be received by a remote computing device such as a group manager. The activity data can include measurements over a period of time, including but not limited to changes in the number of members, rates at which members leave or join the group, etc. The activity data can also provide measurements regarding the amount of data shared by the group and / or data defining the age of encryption keys used by client devices and stored on server 120.

[0125] Next, at operation 953, one or more program modules analyze the activity data to determine whether a change in the number of members or other activity data satisfies one or more criteria. As described herein, one or more of the following measurements can be analyzed relative to one or more thresholds: a change in the number of members of a group, an amount of data shared by a group, and / or an age of keys utilized by a group. When the activity data meets or exceeds the one or more thresholds, it can be determined that the one or more criteria are satisfied.

[0126] If the change in the number of members or other activity data does not meet the one or more criteria, the routine 950 returns to operation 951, where one or more program modules receive the updated activity data. One or more program modules can continue to monitor the updated activity data until one or more measurements defined in the activity data meet the one or more criteria. When the one or more measurements defined in the activity data meet the one or more criteria, the routine 950 continues to operation 955, where one or more modules verify group membership. In this operation, a verification request can be sent from the server 120 to the group manager 115. The group manager 115 can verify the current list of members of the particular group via confirmation 122.

[0127] Next, at operation 957, one or more program modules can transmit an update command to the client devices associated with each member of the group. The update command can cause each of the client devices to update one or more keys on each client device. As described herein, the update command can cause each client device to replace an existing key, such as a secret key, a key pair, and / or a vault key, with a new key. In some configurations, the server 120 can generate a vault key and transmit the vault key to each client in association with the update command. The update command can cause each client device to generate encrypted data, including an encrypted payload of secret data using the one or more updated keys, an encrypted secret key, and an encrypted vault key.

[0128] Next, at operation 959, one or more program modules can receive newly generated encrypted data from the client device. In some configurations, the server 120 can receive newly generated encrypted data, such as an encrypted payload of secret data using one or more updated keys, an encrypted secret key, and an encrypted vault key.

[0129] Next, at operation 961, one or more program modules can store the encrypted data in a vault associated with the user group. Prior to storing the received data and some configurations, the server 120 can verify each member of the group before storing the data for each group member. For example, if the group includes members of a channel, the server 120 can send a verification request with the identity of the user to the group manager 115. If the group manager 115 responds with an acknowledgement 122 verifying that the user is still a member of the channel, the server 120 can store the newly encrypted data in association with the user and the group.

[0130] Reference now Figures 19A-19G, below, techniques for managing access rights to secret data shared by a group of users are shown and described. The techniques disclosed herein allow storage services to coordinate with group management systems such as MS Teams or Slack to verify membership of a user's group, such as a channel, chat session, meeting. The two systems, which may be operated by different entities, can automatically change access rights to stored data when a user leaves or joins a group. The techniques disclosed herein can provide many technical benefits that can mitigate or eliminate the need for the manual task of removing, adding, or modifying access permissions by leveraging data provided by a group manager.

[0131] Fig.19A Aspects of the system 100 that allow the server 120 to control access to data stored in the vault 109 based on the user activity of the group manager 115 are illustrated. The group manager 115 can manage communication sessions, such as channels, between users of the group. For purposes of illustration, a channel includes a communication session that allows a user to join a public or private group. Once a member, the user can share messages and other forms of data with other members. Fig.19A 4 shows an exemplary user interface 401 for a channel. In this example, a group (e.g., a channel) includes a single member 107A, Carol, associated with a user identity 113A, and the user identity is associated with a group ID 112A. At the server 120, the group ID is associated with the vault 109, and the user identity 113A is also associated with the group ID 112 at the server.

[0132] In this example, the server 120 also includes a vault 109 for storing encrypted data for current group members. The server 120 is capable of controlling access to the vault 109 storing encrypted data, such as encrypted secret data 1 101A' generated by encrypting secret data 1 101A using secret key 1 102A, encrypted secret key 1 102A' generated by encrypting secret key 1 102A using vault key 104 associated with user group 111, and encrypted vault key 1104' generated by encrypting vault key 104 using public key 1 105A of a first private key-public key pair 157A associated with a first user 107A of user group 111. As described in more detail below, access to the vault 109 for individual users is controlled based on the membership status of the user group 111.

[0133] Fig.19B1 illustrates aspects of a process for adding an individual to a user group 111. In this example, in response to detecting that a user has been added, the group manager 115 sends membership data 155 indicating the new member of the user group 111. The membership data 155 can also indicate persons that have been removed from the group 111. Additionally, the membership data 155 can also indicate changes in permissions relative to the members of the user group 111. Fig.19C In the example of , membership data 155 indicates that the first user (User 1) is a current member of group 111 (Group 1). In addition, membership data 165 indicates that the second user is a new member of the group. This example is provided for illustrative purposes and should not be construed as limiting. It can be appreciated that the membership data 155 indicating a new user of the group can be provided by any computing device, including a client device. In such an embodiment, when the membership data 155 is received from the client device, the server 120 can verify that the user sending the membership data 155 is still an active member of the group before allowing the server to take action on the membership data. In addition, the server 120 can also determine whether the user sending the membership data 155 has the appropriate administrative permissions to add users to the vault. If the user associated with the membership data 155 does not have the appropriate permissions, the server can deny any action based on the membership data 155.

[0134] Users can be added to a group using a variety of different methods. For example, an administrator of the group (such as the first user 107A) can allow new users to join the group. In such an embodiment, the administrator can add the identity of the new user and also define one or more permissions. In other embodiments, users can join a public group without requiring proof of membership or approval of a request to join.

[0135] There are multiple techniques for adding users to a group. In one illustrative example, the first method involves a process initiated by the group owner. When an administrator adds an individual to a group (such as a channel), the group owner can cause the system to collect the new user's public key. The group owner can then cause the system to encrypt a vault key for each new user with each user's public key. Each new user is able to access a unique data structure that allows them to access the group's shared data.

[0136] The second method involves a process initiated when a public join link is created, for example, anyone can use the link to join the Seattle Running Club channel. The system can allow access to the secret data by collecting a public key from any new user and encrypting the vault key with that public key. The system can allow any member of the group to approve the entry of new users, not just group administrators.

[0137] In response to receiving the membership data 155 indicating the addition of the second user 107B to the group 111, the server 120 can also configure the vault to allow storage of encrypted data associated with the second user 107B by associating the second identity 113B with the vault 109. The vault 109 can be configured to grant the second user 107B permission to store encrypted data while the second user 107B is a current member of the user group 111.

[0138] Additionally, once server 120 receives an indication of a new member of the user's group, server 120 can issue one or more commands to cause the current member's client device to generate a vault key based on its encrypted vault key and to cause an encrypted vault to be generated using the new member's public key. Fig.19D In this example of the stage shown in , in response to receiving membership data 155 indicating the addition of a second user 107B of the group 111, the server 120 can transmit an update command 156 to a client device 110A associated with a current member (e.g., the first user 107A). The update command 156 causes the client device 110A to generate an encrypted vault key 2 104B' by encrypting the vault key 104 using the public key 2 105B of the second private key-public key pair 157B associated with the second user 107B of the user group 111. The server 120 can provide the update command 156 to the public key 2 105B of the second private key-public key pair 157B, or the public key 2 105B can be obtained by the client device 110A from another resource (such as the second client 110B or a key service). If the vault key does not exist on the client computer 110A, the server 120 can provide the encrypted vault key 1, which can be decrypted by the private key of the first user. The encrypted Vault Key 1 can also be provided by the first client device 110A or by a service such as a remote key storage service.

[0139] In some configurations, a single client device or a selected group of client devices can be selected to generate encrypted data for a new user. The selection of a device for generating encrypted data can be based on the role or permission for each member. For example, if a user is a designated administrator for a group, the user and the user's corresponding device can be selected to provide an encrypted vault key for the new user. In other configurations, client devices can communicate with each other on a peer-to-peer basis to determine which device will generate an encrypted vault key for the new user. The device can be selected based on the activity of the device or one or more capabilities of the individual device. For example, if it is determined that a specific computing device remains online relative to other devices within a period of time, the specific computing device can be selected to generate an encrypted vault key for the new user. In another example, if it is determined that a specific computing device has an architecture that is more conducive to generating keys, for example, a desktop with a specific processor compared to a mobile device, the specific computing device can be selected in a pool of other candidate devices.

[0140] As in Fig.19E , the new user's vault key can be transmitted to the new user's client device 110B directly from the first client 110A (as shown with a dashed line) or by using another resource such as a key service. The new user's vault key can also be transmitted to the server for storage in the vault 109 and / or transmitted from the server 120 to the new user's client device 110B. In this example, as shown in Fig.19F As shown in , the encrypted vault key 2 104B' can be stored at the server and / or transmitted to the client device 110B. The encrypted vault key 2 104B' is configured to generate the vault key 104 at the second client device 110B by using the private key 2 106B of the second private key-public key pair 157B. The vault key 104 can then enable the second client device 110B to generate the encrypted secret key 2 102B' from the secret key 2 102B, and the secret key 2 102B enables the second client device 110B to generate the encrypted secret data 2 101B' from the secret data 2 101B.

[0141] To store the encrypted data at the server 120, the client device 110B can send a write request 158 ​​to the server to request that the server 120 store the encrypted secret data 2 101B', the encrypted secret key 2 102B', and the encrypted vault key 2 104B' in association with the second user 107B in the vault 109. The write request 158 ​​can include the encrypted data (as shown), or the write request 158 ​​can be sent independently of the encrypted data.

[0142] As in Fig.19FAs shown in , in response to the write request 158, the server can use the confirmation data 122 from the group manager to determine whether the second user 107B is a current member of the user group 111. The confirmation data 122 can be sent to the server in response to the verification request 121. If the confirmation data 122 confirms that the requesting user (the second user 107B) is a current member of the group 111, the server 120 can store the encrypted secret data 2 101B', the encrypted secret key 2 102B', and the encrypted vault key 2 104B' in the vault 109. However, if the confirmation data 122 shows that the requesting user (e.g., the second user 107B) is no longer a member of the group, if the second user 107B does not have write access or if the second user 107B is not a current member of the group 111, the server 120 denies the write request by restricting the second user from storing the encrypted secret data 2 101B' and the encrypted secret key 2 102B' in the vault 109.

[0143] This embodiment also allows users to share data, refer to Figure 2D-2G , the process for sharing data between users can occur after the new user has been added. Therefore, in the current example, once the second user has been added to the group, the server 120 can receive an access request associated with the second user, wherein the access request requests the encrypted secret data 101A' stored in the vault associated with the first user. In response to the access request, the server 120 can transmit a verification request to the group manager 115. The verification request can include the identity of the second user and a group identifier associated with the group and the vault. The group manager 115 can check one or more records and send a roster or access confirmation to the server. The roster or access confirmation can indicate that the second user is a current member of the group, or that the second user is not a current member of the group. In response to determining that the second user is a current member of the group, the server 120 can allow the encrypted secret data 1 101A', the encrypted secret key 1 102A' and the encrypted vault key 2 104B' to be transmitted to the requesting client device associated with the access request. Encrypted Vault Key2 104B' can be configured to enable generation of Vault Key 104 at a requesting client device using Private Key2 106B of second private-public key pair 157B. Vault Key 104 can enable generation of Secret Key 1, and Secret Key 1 can enable generation of Secret Data 1 101A.

[0144] refer to Fig. 20, a routine 975 for managing user permissions for a vault system based on group membership activity is shown and described below. Routine 975 begins at operation 976, where program module 623 controls access to a vault 109 storing encrypted data, such as encrypted secret data 1 101A', encrypted secret key 1 102A', and encrypted vault key 1 104'. Encrypted secret data 1 101A' is generated by encrypting secret data 1 101A using secret key 1 102A, encrypted secret key 1 102A' is generated by encrypting secret key 1 102A using vault key 104 associated with user group 111, and encrypted vault key 1104' is generated by encrypting vault key 104 using public key 1 105A of a first private key-public key pair 157A associated with a first user 107A of user group 111. Access to the vault 109 by individual users is controlled based on membership status of the user group 111 and permissions that can be provided by a group administrator.

[0145] A "group of users" as defined herein can include a group of computer users who are listed as members in a roster of a communication session or conference. A communication session can be managed by a system that can share text messages, data files, video charges, real-time video, and audio or other forms of data. Each user can join a group manually, be invited by a member, and / or a system administrator can grant permission to participate in a communication session. Each member can be authenticated to participate in a communication session using any suitable certificate. A user can leave a group by an input command issued by a member, by a group member, and / or by a system administrator.

[0146] At operation 977, program module 623 receives membership data 155 indicating that a new member, e.g., second user 107B, has been added to the group. Server 120 can also configure the vault in operation 977 to allow storage of encrypted data associated with the new member, e.g., second user 107B, by associating second identity 113B with vault 109. Vault 109 can be configured to grant permission for second user 107B to store encrypted data while second user 107B is a current member of user group 111.

[0147] At operation 978, program module 623 can issue one or more update commands to cause the client device of the current member to generate a vault key based on its encrypted vault key. The command can also cause the encrypted vault to be generated using the public key of the new member. Fig.19DAs described in the example of , in response to receiving membership data 155 indicating the addition of a second user 107B of a group 111, the server 120 can transmit an update command 156 to a client device 110A associated with a current member (e.g., the first user 107A). The update command 156 causes the client device 110A to generate an encrypted vault key 2 104B' by encrypting the vault key 104 using the public key 2 105B of the second private key-public key pair 157B associated with the second user 107B of the user group 111. The server 120 can provide the update command 156 to the public key 2 105B of the second private key-public key pair 157B, or the public key 2 105B can be obtained by the client device 110A from another resource (such as the second client 110B or a key service). If the vault key does not exist on the client computer 110A, the server 120 can provide the encrypted vault key 1, which can be decrypted by the private key of the first user. The encrypted Vault Key 1 can also be provided by the first client device 110A or by a service such as a remote key storage service.

[0148] At operation 979, program module 623 receives write request 158, server request server 120 to store encrypted data. In one example, the request can include or reference encrypted secret data 2 101B', encrypted secret key 2 102B', and encrypted vault key 2 104B', and direct such data to be stored in vault 109 in association with second user 107B. Write request 158 ​​can include the encrypted data, or can be sent independently of the encrypted data.

[0149] At operation 980, the program module 623 receives a confirmation from the group manager 115 indicating the membership status of one or more users. In one illustrative example, the confirmation can include the group ID and the membership status of at least one user ID, for example, the first user 107A is a current member, or the first user 107A is not a current member. The confirmation can also include one or more permissions for each user. For example, the confirmation can include the user ID and indicate whether the user ID is associated with read and / or write permissions. The confirmation can also describe the role or other attributes associated with the individual user ID. In one illustrative example, reference is made to Figure 1 , the computing device can receive a group confirmation 122 from the group management system 115 , and the group confirmation 122 can indicate the status of the first user 107 and the one or more group identifiers 112 .

[0150] At operation 981, in response to receiving a group confirmation 112 indicating that a user (such as second user 107B) is associated with a particular group, the routine 975 proceeds to operation 982, wherein the program module 623 can take a number of actions to allow the transfer and / or storage of encrypted data, such as encrypted secret data, encrypted secret keys, and encrypted vault keys. However, if the group confirmation 112 indicates that the user (such as second user 107B) is not associated with the particular group, the routine 975 proceeds to operation 983, wherein the program module 623 can take a number of actions to restrict the transfer and / or storage of encrypted data, such as encrypted secret data, encrypted secret keys, and encrypted vault keys.

[0151] Fig.21 Additional details of an exemplary computer architecture 600 for a computer, such as server 120 or one of client devices 110 ( Figure 1 ), capable of running the program components described above to provide enhanced security for encrypted data. Fig.21 The computer architecture 600 illustrated in the figure illustrates an architecture for a server computer, a mobile phone, a PDA, a smart phone, a desktop computer, a netbook computer, a tablet computer, and / or a laptop computer. The computer architecture 600 can be used to run any aspect of the software components presented herein.

[0152] exist Fig.21 The computer architecture 600 illustrated in FIG. 6 includes a central processing unit 602 (“CPU”), a system memory 604 (including random access memory 606 (“RAM”) and read-only memory (“ROM”) 606), and a system bus 610 that couples the memory 604 to the CPU 602. A basic input / output system containing basic routines that help transfer information between elements within the computer architecture 600, such as during startup, is stored in the ROM 606. The computer architecture 600 also includes a mass storage device 612 for storing an operating system 607 and one or more application programs, including, but not limited to, program modules 623. The illustrated mass storage device 612 may also store files 622, which may include encryption keys, encrypted data, or other data necessary to operate the techniques described herein.

[0153] The mass storage device 612 is connected to the CPU 602 through a mass storage device controller (not shown) connected to the bus 610. The mass storage device 612 and its associated computer-readable media provide non-volatile storage for the computer architecture 600. Although the description of computer-readable media contained herein refers to a mass storage device, such as a solid-state drive, hard disk, or CD-ROM drive, those skilled in the art will appreciate that the computer-readable media can be any available computer storage media or communication media accessible by the computer architecture 600.

[0154] Communication media includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transmission mechanism, including any transmission medium. The term "modulated data signal" means a signal that changes or sets one or more of its characteristics in a manner that encodes the information in the signal. By way of example and not limitation, communication media include wired media such as a wired network or a direct wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media.

[0155] By way of example and not limitation, computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. For example, computer media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid-state storage technology, CD-ROM, digital versatile disk ("DVD"), HD-DVD, BLU-RAY or other optical storage devices, cassettes, magnetic tape, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by the computer architecture 600. For the purposes of the claims, the phrases "computer storage medium", "computer readable storage medium" and variations thereof do not include waves, signals and / or other transient and / or intangible communication media themselves.

[0156] According to various configurations, the computer architecture 600 can operate in a networked environment using logical connections to remote computers through the network 125 and / or another network (not shown). The computer architecture 600 can be connected to the network 125 via a network interface unit 614 connected to the bus 610. It should be appreciated that the network interface unit 614 can also be used to connect to other types of networks and remote computer systems. The computer architecture 600 can also include an input / output controller 616 for receiving and processing input from a variety of other devices, including a keyboard, a mouse, or an electronic stylus (in the case of a computer). Fig.21Similarly, the input / output controller 616 may provide output to a display screen, a printer, or other type of output device (not shown in FIG. Fig.21 ).

[0157] It should be appreciated that the software components described herein can be converted from a general-purpose computing system to a special-purpose computing system customized to facilitate the functions presented herein when the software components are loaded into the CPU 602 and are run. The CPU 602 can be composed of any number of transistors or other discrete circuit elements, which can present any number of states individually or collectively. More specifically, the CPU 602 can be operated as a finite state machine to respond to executable instructions contained in the software modules disclosed herein. These computer executable instructions can convert the CPU 602 by specifying how the CPU 602 is converted between states, thereby converting the transistors or other discrete hardware elements that constitute the CPU 602.

[0158] Encoding the software modules presented herein may also transform the physical structure of the computer-readable medium presented herein. In different implementations of the present description, the specific transformation of the physical structure may depend on various factors. Examples of such factors may include, but are not limited to, the technology used to implement the computer-readable medium, whether the computer-readable medium is characterized as a primary or secondary storage device, etc. For example, if the computer-readable medium is implemented as a semiconductor-based memory, the software disclosed herein may be encoded on the computer-readable medium by transforming the physical state of the semiconductor memory. For example, the software may transform the state of transistors, capacitors, or other discrete circuit elements that constitute the semiconductor memory. The software may also transform the physical state of such components in order to store data thereon.

[0159] As another example, the computer readable medium disclosed in this article can be implemented using magnetic or optical technology. In such an implementation, when software is encoded therein, the software presented in this article can convert the physical state of the magnetic medium or optical medium. These conversions can include changing the magnetic properties of a specific location in a given magnetic medium. These conversions can also include changing the physical characteristics or properties of a specific location in a given optical medium to change the optical properties of those locations. Without departing from the scope and spirit of this description, other transformations of the physical medium are possible, and the aforementioned examples are provided only for ease of discussion.

[0160] In view of the above, it should be appreciated that many types of physical transformations occur in the computer architecture 600 in order to store and run the software components presented herein. It should also be appreciated that the computer architecture 600 may include other types of computing devices, including handheld computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those skilled in the art. It is also contemplated that the computer architecture 600 may not include Fig.21 All components shown in the components can be included in Fig.21 Other components not explicitly shown in the drawings or the like may be utilized. Fig.21 A completely different architecture than the one shown in .

[0161] Fig. 22 An illustrative distributed computing environment 700 capable of running the software components described herein to provide enhanced security for encrypted data, among other aspects, is depicted. Fig. 22 The distributed computing environment 700 illustrated in FIG. 700 can be used to run any aspects of the software components presented herein. For example, the distributed computing environment 700 can be used to run various aspects of the program module 623 and / or other software components described herein.

[0162] According to various implementations, the distributed computing environment 700 includes a computing environment 702 that operates on, communicates with, or is part of a network 125. The network 125 may be or may include the network 125, as described above with reference to Fig.21 The network 125 can also include various access networks. One or more client devices 706A-706N (hereinafter collectively and / or generally referred to as "clients 706") can access the network 125 and / or other connections (in Fig. 22 In one illustrated configuration, the client 706 includes a computing device 706A, such as a laptop, desktop computer, or other computing device; a tablet or tablet computing device ("tablet computing device") 706B; a mobile computing device 706C, such as a mobile phone, smart phone, or other mobile computing device; a server computer 706D; and / or other devices 706N. It should be understood that any number of clients 706 can communicate with the computing environment 702. Figure 6 and Figure 8 Two exemplary computing architectures are illustrated and described for the client 706. It should be understood that the illustrated client 706 and the computing architectures illustrated and described herein are illustrative and should not be construed as being limiting in any way.

[0163] In the illustrated configuration, the computing environment 702 includes an application server 708, a data storage device 710, and one or more network interfaces 712. According to various implementations, the functionality of the application server 708 can be provided by one or more server computers running as part of the network 125 or communicating with the network 125. The application server 708 can host various services, virtual machines, portals, and / or other resources. In the illustrated configuration, the application server 708 can host one or more virtual machines for running applications or other functions. According to various implementations, the virtual machine can run one or more applications and / or software modules, which are used to provide enhanced security for encrypted data. It should be understood that this configuration is illustrative and should not be interpreted as limiting in any way. The application server 708 also hosts or provides access to one or more portals, link pages, websites, and / or other information ("web portals") 716. The web portal 716 can be used to communicate with one or more client computers.

[0164] As in Fig. 22 As shown in FIG. 7 , the application server 708 can also host other services, applications, portals, and / or other resources (“other resources”) 724. Other resources 724 can deploy a service-oriented architecture or any other client-server management software. It can therefore be appreciated that the computing environment 702 can provide the integration of the concepts and technologies disclosed herein with various mailboxes, messaging, social networks, and / or other services or resources.

[0165] As mentioned above, the computing environment 702 can include a data storage device 710. According to various implementations, the functionality of the data storage device 710 is provided by one or more databases operating on or in communication with the network 125. The functionality of the data storage device 710 can also be provided by one or more server computers configured to host data for the computing environment 702. The data storage device 710 can include, host, or provide one or more real or virtual containers 726A-726N (hereinafter collectively and / or generally referred to as "containers 726"). The containers 726, which can be used to form key containers 131 or secret containers 115, are configured to host data and / or other data used or created by the application server 708. Although in Fig. 22 726 for executing modules such as program module 623. Aspects of container 726 can be connected to a database program, a file system, and / or any program that stores data with secure access features. Aspects of container 726 can also be implemented using products or services such as ACTIVEDIRECTORY, DKM, ONEDRIVE, DROPBOX, or GOOGLEDRIVE.

[0166] The computing environment 702 can communicate with or be accessed by a network interface 712. The network interface 712 can include various types of network hardware and software for supporting communications between two or more computing devices, including but not limited to the client 706 and the application server 708. It should be appreciated that the network interface 712 can also be used to connect to other types of networks and / or computer systems.

[0167] It should be understood that the distributed computing environment 700 described herein can provide any number of virtual computing resources to any aspect of the software elements described herein and / or can be configured to run other distributed computing functions of any aspect of the software elements disclosed herein. According to various implementations of the concepts and technologies disclosed herein, the distributed computing environment 700 provides the software functions described herein as a service to the client 706. It should be understood that the client 706 can include real or virtual machines, including but not limited to: server computers, network servers, personal computers, mobile computing devices, smart phones and / or other devices. In this way, various configurations of the concepts and technologies disclosed herein enable any device configured to access the distributed computing environment 700 to utilize the functions described herein to provide enhanced security for encrypted data, as well as other aspects. In one specific example, as outlined above, the technology described herein can be at least partially implemented by a client 706 related to Fig. 22 The application server 708 is implemented in conjunction with a working web browser application.

[0168] Now turn to Fig.23 , an illustrative computing device architecture 800 for a computing device capable of running various software components described herein for providing enhanced security for encrypted data. The computing device architecture 800 is applicable to computing devices that facilitate mobile computing due in part to form factor, wireless connectivity, and / or battery powered operation. In some configurations, the computing device includes, but is not limited to: a mobile phone, a tablet device, a slate device, a portable video game device, etc. The computing device architecture 800 is applicable to computing devices that facilitate mobile computing due in part to form factor, wireless connectivity, and / or battery powered operation. In some configurations, the computing device includes, but is not limited to: a mobile phone, a tablet device, a slate device, a portable video game device, etc. Fig. 22 In addition, aspects of computing device architecture 800 may be applicable to conventional desktop computers, portable computers (e.g., laptop computers, notebook computers, ultraportable computers, and netbooks), server computers, and other computer systems, such as those described herein. Fig.23 For example, the single-touch and multi-touch aspects disclosed below can be applied to a desktop computer utilizing a touch screen or some other touch-enabled device, such as a touch-enabled track pad or a touch-enabled mouse.

[0169] exist Fig.23 The computing device architecture 800 illustrated in FIG. 8 includes a processor 802, a memory component 804, a network connection component 806, a sensor component 808, an input / output component 810, and a power supply component 812. In the illustrated configuration, the processor 802 communicates with the memory component 804, the network connection component 806, the sensor component 808, the input / output ("I / O") component 810, and the power supply component 812. Fig.23 The connections between individual components are not shown, but the components can interact to perform device functions. In some configurations, the components are arranged to communicate via one or more buses (not shown).

[0170] The processor 802 includes a central processing unit ("CPU") configured to process data, execute computer-executable instructions of one or more applications, and communicate with other components of the computing device architecture 800 in order to perform the various functions described herein. The processor 802 can be used to run various aspects of the software components presented herein, and in particular, those aspects that utilize, at least in part, touch-enabled input.

[0171] In some configurations, the processor 802 includes a graphics processing unit ("GPU") configured to accelerate operations performed by the CPU, including, but not limited to, operations performed by running general scientific and / or engineering computing applications and graphics-intensive computing applications, such as high-resolution video (e.g., 720P, 1080P, and higher resolutions), video games, three-dimensional ("3D") modeling applications, etc. In some configurations, the processor 802 is configured to communicate with a discrete GPU (not shown). In any case, the CPU and GPU can be configured according to a co-processing CPU / GPU computing model, in which the sequential portion of the application runs on the CPU and the computationally intensive portion is accelerated by the GPU.

[0172] In some configurations, the processor 802, along with one or more of the other components described below, is or is included in a system on a chip ("SoC"). For example, the SoC may include the processor 802, a GPU, one or more network connection components 806, and one or more sensor components 808. In some configurations, the processor 802 is manufactured in part using package-on-package ("PoP") integrated circuit packaging technology. The processor 802 may be a single-core or multi-core processor.

[0173] The processor 802 may be created in accordance with an ARM architecture, which may be licensed from ARM HOLDINGS of Cambridge, United Kingdom. Alternatively, the processor 802 may be created in accordance with an x86 architecture, such as available from INTEL CORPORATION of Mountain View, California, or the like. In some configurations, the processor 802 is a SNAPDRAGON SoC available from QUALCOMM of San Diego, California, a TEGRA SoC available from NVIDIA of Santa Clara, California, a HUMMINGBIRD SoC available from SAMSUNG of Seoul, South Korea, an Open Multimedia Application Platform ("OMAP") SoC available from TEXAS of Dallas, Taxicabs, a customized version of any of the above SoCs, or a proprietary SoC.

[0174] The memory component 804 includes random access memory (“RAM”) 814, read-only memory (“ROM”) 816, integrated storage memory (“integrated storage”) 818, and removable storage memory (“removable storage”) 820. In some configurations, the RAM 814 or a portion thereof, the ROM 816 or a portion thereof, and / or some combination of the RAM 814 and ROM 816 are integrated into the processor 802. In some configurations, the ROM 816 is configured to store firmware, an operating system or a portion thereof (e.g., an operating system kernel), and / or a boot loader to load the operating system kernel from the integrated storage 818 and / or the removable storage 820.

[0175] The integrated storage device 818 can include a solid-state memory, a hard disk, or a combination of a solid-state memory and a hard disk. The integrated storage device 818 can be welded or otherwise connected to a logic board, to which the processor 802 and other components described herein can also be connected. In this way, the integrated storage device 818 is integrated into the computing device. The integrated storage device 818 is configured to store an operating system or portions thereof, application programs, data, and other software components described herein.

[0176] The removable storage device 820 can include a solid-state memory, a hard disk, or a combination of a solid-state memory and a hard disk. In some configurations, a removable storage device 820 is provided to replace the integrated storage device 818. In other configurations, a removable storage device 820 is provided as an additional optional storage device. In some configurations, the removable storage device 820 is logically combined with the integrated storage device 818 so that the total available storage device is available as the total combined storage capacity. In some configurations, the total combined capacity of the integrated storage device 818 and the removable storage device 820 is shown to the user, rather than the individual storage capacities of the integrated storage device 818 and the removable storage device 820.

[0177] The removable storage device 820 is configured to be inserted into a removable storage memory slot (not shown) or other mechanism by which the removable storage device 820 is inserted and secured to facilitate a connection through which the removable storage device 820 can communicate with other components of the computing device, such as the processor 802. The removable storage device 820 can be embodied in various memory card formats, including but not limited to: PC card, CompactFlash card, memory stick, secure digital ("SD"), miniSD, microSD, universal integrated circuit card ("UICC") (e.g., subscriber identity module ("SIM") or universal SIM ("USIM")), proprietary formats, etc.

[0178] It is understood that the one or more memory components 804 can store an operating system. According to various configurations, the operating system includes, but is not limited to: SYMBIAN OS from SYMBIAN LIMITED, WINDOWS MOBILE OS from Microsoft Corporation of Redmond, Washington, WINDOWSPHONE OS from Microsoft Corporation, WINDOWS from Microsoft Corporation, PALM WEBOS from Hewlett-Packard Company of Palo Alto, California, BLACKBERRY OS from Research InMotion Limited of Walterloo, Ontario, Canada, IOS from Apple Inc. of Cupertino, California, and ANDROID OS from Google Inc. of Mountain View, California. Other operating systems are also contemplated.

[0179] The network connectivity component 806 includes a wireless wide area network component ("WWAN component") 822, a wireless local area network component ("WLAN component") 824, and a wireless personal area network component ("WPAN component") 826. The network connectivity component 806 facilitates communication to and from the network 125 or another network, which may be a WWAN, WLAN, or WPAN. Although only the network 125 is shown, the network connectivity component 806 may facilitate simultaneous communication with multiple networks, including Fig. 20 The network 125. For example, the network connection component 806 can facilitate simultaneous communication with multiple networks via one or more WWANs, WLANs, or WPANs.

[0180] The network 125 may be or may include a WWAN, such as a mobile telecommunication network that utilizes one or more mobile telecommunication technologies to provide voice and / or data services to computing devices utilizing the computing device architecture 800 via the WWAN component 822. The mobile telecommunication technologies can include, but are not limited to, Global System for Mobile Communications (“GSM”), Code Division Multiple Access (“CDMA”) ONE, CDMA2000, Universal Mobile Telecommunications System (“UMTS”), Long Term Evolution (“LTE”), and Worldwide Interoperability for Microwave Access (“WiMAX”). In addition, the network 125 may utilize various channel access methods (which may or may not be used by the above standards), including, but not limited to, time division multiple access (“TDMA”), frequency division multiple access (“FDMA”), CDMA, wideband CDMA (“W-CDMA”), orthogonal frequency division multiplexing (“OFDM”), space division multiple access (“SDMA”), etc. General Packet Radio Service ("GPRS"), Enhanced Data Rates for Global Evolution ("EDGE"), High Speed ​​Packet Access ("HSPA") family of protocols, including High Speed ​​Downlink Packet Access ("HSDPA"), Enhanced Uplink ("EUL") or otherwise known as High Speed ​​Uplink Packet Access ("HSUPA"), Evolved HSPA ("HSPA+"), LTE, and various other current and future wireless data access standards may be used. Network 125 may be configured to provide voice and / or data communications using any combination of the above technologies. Network 125 may be configured or adapted to provide voice and / or data communications in accordance with next generation technologies.

[0181] In some configurations, the WWAN component 822 is configured to provide dual multimode connectivity to the network 125. For example, the WWAN component 822 may be configured to provide connectivity to the network 125, where the network 125 provides services via GSM and UMTS technologies, or via some other combination of technologies. Alternatively, multiple WWAN components 822 may be used to perform such functions, and / or provide additional functionality to support other non-compatible technologies (i.e., not supported by a single WWAN component). The WWAN component 822 may facilitate similar connectivity to multiple networks (e.g., a UMTS network and an LTE network).

[0182] The network 125 may be a WLAN operating in accordance with one or more Institute of Electrical and Electronics Engineers (“IEEE”) 802.11 standards, such as IEEE 802.11a, 802.11b, 802.11g, 802.11n, and / or future 802.11 standards (collectively referred to herein as WI-FI). Draft 802.11 standards are also contemplated. In some configurations, the WLAN is implemented using one or more wireless WI-FI access points. In some configurations, one or more wireless WI-FI access points are another computing device that is connected to a WWAN used as a WI-FI hotspot. The WLAN component 824 is configured to connect to the network 125 via a WI-FI access point. Such a connection may be protected via various encryption techniques, including, but not limited to, WI-FI Protected Access (“WPA”), WPA2, Wired Equivalent Privacy (“WEP”), and the like.

[0183] The network 125 may be a WPAN operating in accordance with the Infrared Data Association ("IrDA"), Bluetooth, wireless Universal Serial Bus ("USB"), Z-Wave, ZIGBEE, or some other short-range wireless technology. In some configurations, the WPAN component 826 is configured to facilitate communication with other devices such as peripherals, computers, or other computing devices via the WPAN.

[0184] The sensor assembly 808 includes a magnetometer 828, an ambient light sensor 830, a proximity sensor 832, an accelerometer 834, a gyroscope 836, and a global positioning system sensor (“GPS sensor”) 838. It is contemplated that other sensors, such as but not limited to temperature sensors or shock detection sensors, may also be incorporated into the computing device architecture 800.

[0185] The magnetometer 828 is configured to measure the strength and direction of the magnetic field. In some configurations, the magnetometer 828 provides measurements to a compass application stored in one of the memory components 804 to provide the user with accurate directions in a reference system, including cardinal directions, north, south, east, and west. Similar measurements can be provided to a navigation application including a compass component. Other uses of the measurements obtained by the magnetometer 828 are contemplated.

[0186] The ambient light sensor 830 is configured to measure ambient light. In some configurations, the ambient light sensor 830 provides measurements to an application stored in one of the memory components 804 to automatically adjust the brightness of the display (as described below) to compensate for low light and high light environments. Other uses of the measurements obtained by the ambient light sensor 830 are contemplated.

[0187] The proximity sensor 832 is configured to detect the presence of an object or thing in proximity to the computing device without direct contact. In some configurations, the proximity sensor 832 detects the presence of a user's body (e.g., the user's face) and provides this information to an application stored in one of the memory components 804, which uses the proximity information to enable or disable certain features of the computing device. For example, a phone application can automatically disable the touch screen (as described below) in response to receiving proximity information so that the user's face does not inadvertently end a call during a call or enable / disable other features within the phone application. Other uses of the proximity detected by the proximity sensor 828 are contemplated.

[0188] The accelerometer 834 is configured to measure appropriate acceleration. In some configurations, the output from the accelerometer 834 is used by an application as an input mechanism to control some functions of the application. For example, the application may be a video game in which a character, a portion of a character, or an object is moved or otherwise manipulated in response to input received via the accelerometer 834. In some configurations, the output from the accelerometer 834 is provided to an application for switching between horizontal and vertical modes, calculating coordinate acceleration, or detecting a fall. Other uses of the accelerometer 834 are contemplated.

[0189] The gyroscope 836 is configured to measure and maintain orientation. In some configurations, the output from the gyroscope 836 is used by an application as an input mechanism to control some functions of the application. For example, the gyroscope 836 can be used to accurately identify motion within a 3D environment of a video game application or some other application. In some configurations, the application utilizes the output from the gyroscope 836 and the accelerometer 834 to enhance control of some functions of the application. Other uses of the gyroscope 836 are contemplated.

[0190] The GPS sensor 838 is configured to receive signals from GPS satellites for calculating a position. The position calculated by the GPS sensor 838 can be used by any application that needs or benefits from position information. For example, the position calculated by the GPS sensor 838 can be used with a navigation application to provide directions from the position to the destination or from the destination to the position. In addition, the GPS sensor 838 can be used to provide location information to external location-based services, such as E911 services. The GPS sensor 838 can obtain location information generated via WI-FI, WIMAX and / or cellular triangulation technology, which utilizes one or more network connection components 806 to assist the GPS sensor 838 in obtaining positioning. The GPS sensor 838 can also be used in an assisted GPS ("A-GPS") system.

[0191] The I / O component 810 includes a display 840, a touch screen 842, a data I / O interface component ("data I / O") 844, an audio I / O interface component ("audio I / O") 846, a video I / O interface component ("video I / O") 848, and a camera 850. In some configurations, the display 840 and the touch screen 842 are combined. In some configurations, two or more of the data I / O component 844, the audio I / O component 846, and the video I / O component 848 are combined. The I / O component 810 may include a discrete processor configured to support the various interfaces described below, or may include processing functionality built into the processor 802.

[0192] The display 840 is an output device configured to present information in a visual form. Specifically, the display 840 can present graphical user interface ("GUI") elements, text, images, videos, notifications, virtual buttons, virtual keyboards, messaging data, Internet content, device status, time, date, calendar data, preferences, map information, location information, and any other information that can be presented in a visual form. In some configurations, the display 840 is a liquid crystal display ("LCD") utilizing any active or passive matrix technology and any backlight technology (if used). In some configurations, the display 840 is an organic light emitting diode ("OLED") display. Other display types are contemplated.

[0193] The touch screen 842 (also referred to herein as a "touch-enabled screen") is an input device configured to detect the presence and location of a touch. The touch screen 842 may be a resistive touch screen, a capacitive touch screen, a surface acoustic wave touch screen, an infrared touch screen, an optical imaging touch screen, a dispersive signal touch screen, an acoustic pulse recognition touch screen, or may utilize any other touch screen technology. In some configurations, the touch screen 842 is incorporated on top of the display 840 as a transparent layer to enable a user to interact with objects or other information presented on the display 840 using one or more touches. In other configurations, the touch screen 842 is a touch pad incorporated on a surface of a computing device that does not include the display 840. For example, a computing device may have a touch screen incorporated on top of the display 840 and a touch pad on a surface opposite the display 840.

[0194] In some configurations, the touch screen 842 is a single-touch touch screen. In other configurations, the touch screen 842 is a multi-touch touch screen. In some configurations, the touch screen 842 is configured to detect discrete touches, single-touch gestures, and / or multi-touch gestures. For convenience, these are collectively referred to as gestures in this article. Several gestures will now be described. It should be understood that these gestures are illustrative and are not intended to limit the scope of the appended claims. In addition, the gestures, additional gestures, and / or alternative gestures described can be implemented in software used with the touch screen 842. In this way, developers can create gestures specific to specific applications.

[0195] In some configurations, the touch screen 842 supports a tap gesture, wherein the user taps the touch screen 842 once on an item presented on the display 840. The tap gesture can be used for various reasons, including but not limited to opening or launching any content that the user taps. In some configurations, the touch screen 842 supports a double-click gesture, wherein the user taps the touch screen 842 twice on an item presented on the display 840. The double-click gesture can be used for various reasons, including but not limited to zooming in or out in stages. In some configurations, the touch screen 842 supports a tap and hold gesture, wherein the user taps the touch screen 842 and maintains contact for at least a predetermined time. The tap and hold gesture can be used for various reasons, including but not limited to opening a context-specific menu.

[0196] In some configurations, the touch screen 842 supports a pan gesture, wherein a user places a finger on the touch screen 842 and maintains contact with the touch screen 842 while moving the finger on the touch screen 842. Panning can be used for various reasons, including but not limited to moving through a screen, image, or menu at a controlled rate. Multiple finger pan gestures are also contemplated. In some configurations, the touch screen 842 supports a flick gesture, wherein a user slides a finger in the direction in which the user wants the screen to move. The flick gesture can be used for various reasons, including but not limited to scrolling a menu or page horizontally or vertically. In some configurations, the touch screen 842 supports a pinch and stretch gesture, wherein a user performs a pinching motion with two fingers (e.g., a thumb and index finger) on the touch screen 842 or moves the two fingers apart. The pinch and stretch gesture can be used for various reasons, including but not limited to gradually zooming in or out of a website, map, or picture.

[0197] Although the above gestures have been described with reference to being performed using one or more fingers, other appendages such as toes or objects such as a stylus may be used to interact with the touch screen 842. As such, the above gestures should be understood to be illustrative and should not be construed as limiting in any way.

[0198] The data I / O interface component 844 is configured to facilitate inputting data to and outputting data from the computing device. In some configurations, the data I / O interface component 844 includes a connector configured to provide a wired connection between the computing device and the computer system, for example, for synchronization operation purposes. The connector can be a proprietary connector or a standardized connector, such as USB, micro USB, mini USB, etc. In some configurations, the connector is a docking connector, which is used to dock the computing device with another device such as a docking station, an audio device (e.g., a digital music player), or a video device.

[0199] The audio I / O interface component 846 is configured to provide audio input and / or output capabilities to the computing device. In some configurations, the audio I / O interface component 846 includes a microphone configured to collect audio signals. In some configurations, the audio I / O interface component 846 includes a headphone jack configured to provide a connection for headphones or other external speakers. In some configurations, the audio I / O interface component 846 includes a speaker for outputting audio signals. In some configurations, the audio I / O interface component 846 includes an optical audio cable output.

[0200] The video I / O interface component 848 is configured to provide video input and / or output capabilities to the computing device. In some configurations, the video I / O interface component 848 includes a video connector that is configured to receive video as input from another device (e.g., a video media player such as a DVD or Blu-ray player) or send video as output to another device (e.g., a monitor, a television, or some other external display). In some configurations, the video I / O interface component 848 includes a High Definition Multimedia Interface (“HDMI”), a mini HDMI, a micro HDMI, a DisplayPort, or a proprietary connector for inputting / outputting video content. In some configurations, the video I / O interface component 848 or a portion thereof is combined with the audio I / O interface component 846 or a portion thereof.

[0201] The camera 850 can be configured to capture still images and / or video. The camera 850 can capture images using a charge coupled device ("CCD") or a complementary metal oxide semiconductor ("CMOS") image sensor. In some configurations, the camera 850 includes a flash to assist in taking pictures in low light environments. Settings for the camera 850 can be implemented as hardware or software buttons.

[0202] Although not shown, one or more hardware buttons may also be included in the computing device architecture 800. The hardware buttons may be used to control some operational aspects of the computing device. The hardware buttons may be dedicated buttons or multi-purpose buttons. The hardware buttons may be mechanical or sensor-based.

[0203] The illustrated power assembly 812 includes one or more batteries 852, which can be connected to a battery gauge 854. The batteries 852 can be rechargeable or disposable. Rechargeable battery types include, but are not limited to, lithium polymer, lithium ion, nickel cadmium, and nickel metal hydride. Each battery in the battery 852 can be made of one or more battery cells.

[0204] The battery gauge 854 can be configured to measure battery parameters such as current, voltage, and temperature. In some configurations, the battery gauge 854 is configured to measure the effects of the battery's discharge rate, temperature, age, and other factors to predict the remaining life within a certain error percentage. In some configurations, the battery gauge 854 provides the measurement results to an application, which is configured to use the measurement results to present useful power management data to the user. The power management data may include one or more of the battery percentage used, the battery percentage remaining, the battery condition, the remaining time, the remaining capacity (e.g., in Watt-hours), the current consumption, and the voltage.

[0205] The power assembly 812 may also include a power connector, which may be combined with one or more of the aforementioned I / O assemblies 810. The power assembly 812 may interface with an external power system or charging device via the power I / O assembly.

[0206] The disclosure presented herein may be considered in light of the following terms.

[0207] Item A: A method for maintaining a security key of a storage system 120 for secret data, the method performed by the storage system 120 comprising: receiving activity data 1302, the activity data 1302 indicating a change in the number of members 107 of a group 111 associated with a vault 109 for storing data shared between members 107 of the group 111; determining that the change in the number of members 107 of the group satisfies one or more criteria; in response to determining that the change in the number of members of the group satisfies one or more criteria, transmitting an update command 1310 to a client computer 110, the update command 1310 causing the client computer 110 to replace a vault key 104A* with a new vault key 104A* and a new secret key 102A*. 04A and secret key 102A, the update command causes the client computer 110 to: use the new secret key 102A* to encrypt the secret data 101A to generate updated encrypted secret data 101A'*, use the new vault key 104A* to encrypt the new secret key 102A* to generate updated encryption key 102A'*, encrypt the new vault key 104A* to generate updated encrypted vault key 104A'*; and receive the updated encrypted secret data 101A'*, the updated encrypted secret key 102A'* and the updated encrypted vault key 104A'* for storage in the vault associated with the group identifier 112 and the user identifier 113 of at least one member of the plurality of members 107.

[0208] Clause B: The method of Clause A, wherein the update command causes the client computer to replace an existing public key with a new public key, and the update command causes the client computer to use the new public key to encrypt the new vault key to generate an updated encrypted vault key, wherein the new public key is associated with a new private key configured to decrypt the updated encrypted vault key.

[0209] Clause C: The method of clauses A and B further includes: transmitting a verification request to a group management system, the verification request including the user identifier and the group identifier associated with the secret data, the verification request causing the group management system to send a group confirmation verifying the members of the group; and receiving a group confirmation from the group management system, the group confirmation indicating that the user identity is associated with the group identified by the group identifier, wherein the update command is transmitted to the client computer in response to receiving the group confirmation indicating that the user identity is associated with the group.

[0210] Clause D: The method of clauses AC, wherein the change in the number of members of the group satisfies one or more criteria when the number of members joining the group exceeds a threshold.

[0211] Clause E: The method of clauses AD, wherein the change in the number of members of the group satisfies one or more criteria when the number of members leaving the group exceeds a threshold.

[0212] Clause F: The method of clauses AE, wherein the change in the number of members of the group satisfies one or more criteria when the total number of members of the group exceeds a threshold.

[0213] Clause G: The method of clauses AF, wherein the change in the number of members of the group satisfies one or more criteria when the number of members joining the group within a predetermined time exceeds a threshold.

[0214] Clause H: The method of clauses AG, wherein the change in the number of members of the group satisfies one or more criteria when a rate of change in the number of members of the group exceeds a threshold or falls below the threshold.

[0215] Clause I: The method of clauses AH, wherein a change in the number of members of the group satisfies one or more criteria when a rate of change in the number of members of the group indicates an inflection point.

[0216] Clause J: The method of clause AI, wherein the change in the number of members of the group satisfies one or more criteria when a rate at which members leave the group exceeds a rate threshold.

[0217] Item K: A computer, comprising: a processor; and a computer-readable storage medium in communication with the processor, the computer-readable storage medium having computer-executable instructions stored thereon, the computer-executable instructions, when executed by the processor, causing the computer to obtain activity data indicating a change in the number of members of a predetermined group; determine that the change in the number of members of the predetermined group satisfies one or more criteria; in response to determining that the change in the number of members of the predetermined group satisfies one or more criteria, transmit an update command to a client computer 110 to replace a vault key 104A with a new vault key 104A*, the update command The new command causes the client computer 110 to: use the secret key 102A to encrypt the secret data 101A to generate encrypted secret data 101A', use the new vault key 104A* to encrypt the secret key 102A* to generate an updated encrypted secret key 102A'*, encrypt the new vault key 104A* to generate an updated encrypted vault key 104A'*; and receive the updated encrypted secret data 101A', the updated encrypted secret key 102A'* and the updated encrypted vault key 104A'* for storage in a vault associated with a user identifier and a group identifier.

[0218] Clause L: The system of clause K, wherein the instructions further cause the computer to: determine an age of the vault key, wherein the update command is also transmitted to the client computer in response to determining that the age exceeds an age threshold.

[0219] Clause M: A system of clauses K and L, wherein the instructions further cause the computer to: determine an amount of secret data stored associated with the vault key, wherein the update command is also transmitted to the client computer in response to determining that the amount of secret data stored associated with the vault key exceeds a quantity threshold.

[0220] Clause N: The system of clause KM, wherein the change in the number of members of the predetermined group satisfies one or more criteria when a rate of change in the number of members of the predetermined group exceeds a threshold.

[0221] Clause O: The system of clause KN, wherein the change in the number of members of the predetermined group satisfies one or more criteria when a number of members leaving the predetermined group within a predetermined time exceeds a threshold.

[0222] Clause P: A system comprising: a unit for obtaining activity data indicating a change in the number of members of a predetermined group; a unit for determining that the change in the number of members of the predetermined group satisfies one or more criteria; a unit for transmitting an update command to a client computer 110 to replace a vault key 104A with a new vault key 104A*, the update command causing the client computer 110 to: encrypt secret data 101A using secret key 102A to generate encrypted secret data 101A', encrypt the secret data 101A using the new vault key 104A*, secret key 102A* to generate an updated encrypted secret key 102A'*, encrypting the new vault key 104A* to generate an updated encrypted vault key 104A'*, wherein the update command is transmitted in response to determining that the change in the number of members of the predetermined group meets one or more criteria; and a unit for receiving the updated encrypted secret data 101A', the updated encrypted secret key 102A'* and the updated encrypted vault key 104A'* for storage in a vault associated with a user identifier and a group identifier.

[0223] Clause Q: The system of clause P, further comprising means for determining an age of the vault key, wherein the update command is also transmitted to the client computer in response to determining that the age of the vault key exceeds an age threshold.

[0224] Clause R: The system of clauses P and Q, further comprising a unit for determining an amount of secret data stored in association with the vault key, wherein the update command is also transmitted to the client computer in response to determining that the amount of secret data stored in association with the age of the vault key exceeds a quantity threshold.

[0225] Clause S: ​​The system of clause PR, wherein the change in the number of members of the predetermined group satisfies one or more criteria when a rate of change in the number of members of the predetermined group exceeds a threshold.

[0226] Clause T: The system of Clause PS also includes a unit for sending the encrypted vault key, the encrypted secret key and the encrypted secret data to the client computer, wherein the update command also causes the client computer to decrypt the encrypted vault key using the private key to generate the vault key, decrypt the encrypted secret key to generate the secret key by using the vault key, and decrypt the encrypted secret data to generate the secret data using the secret key.

[0227] Based on the foregoing, it should be appreciated that concepts and techniques for providing enhanced security for encrypted data have been disclosed herein. Although the subject matter presented herein has been described in language specific to computer structural features, methods and conversion actions, specific computing machines, and computer-readable media, it should be understood that the invention defined in the appended claims is not necessarily limited to the specific features, actions, or media described herein. Instead, specific features, actions, and media are disclosed as exemplary forms of implementing the claims.

[0228] The subject matter described above is provided by way of illustration only and should not be construed as limiting. Various modifications and changes may be made to the subject matter described herein without following the exemplary configurations and applications illustrated and described, and without departing from the true spirit and scope of the invention as set forth in the appended claims.

Claims

1. A method for maintaining a security key of a storage system for secret data, the method performed by the storage system comprising: receiving activity data indicating a change in a number of the members of the group associated with a vault for storing data shared among members of the group; Determining that the change in the number of members of the group satisfies one or more criteria, wherein the change in the number of members of the group is determined to satisfy one or more criteria when: the number of members joining the group exceeds a threshold; or the number of members leaving the group exceeds a threshold; or The total number of members of the group exceeds a threshold; or The number of members joining the group within a predetermined time exceeds a threshold; or the rate of change of the number of members of the group exceeds a threshold or falls below the threshold; or a rate of change of the number of members of the group indicates an inflection point; or a rate at which members leave the group exceeds a rate threshold; In response to determining that the change in the number of members of the group satisfies one or more criteria, transmitting an update command to the client computer, the update command causing the client computer to replace the vault key and the secret key with a new vault key and a new secret key, the update command causing the client computer to: encrypt secret data using the new secret key to generate updated encrypted secret data, encrypt the new secret key using the new vault key to generate an updated encrypted secret key, encrypt the new vault key to generate an updated encrypted vault key; and The updated encrypted secret data, the updated encrypted secret key, and the updated encrypted vault key are received for storage in the vault associated with a group identifier and a user identifier of at least one of a plurality of members.

2. The method according to claim 1, wherein: The update command causes the client computer to replace the existing public key with a new public key, and the update command causes the client computer to use the new public key to encrypt the new vault key to generate the updated encrypted vault key, wherein the new public key is associated with a new private key configured to decrypt the updated encrypted vault key.

3. The method according to claim 1, further comprising: transmitting a verification request to a group management system, the verification request including the user identifier and the group identifier associated with the secret data, the verification request causing the group management system to send a group confirmation verifying the member of the group; as well as A group confirmation is received from the group management system, the group confirmation indicating that the user identity is associated with the group identified by the group identifier, wherein the update command is transmitted to the client computer in response to receiving the group confirmation indicating that the user identity is associated with the group.

4. A computer, comprising: processor; as well as a computer-readable storage medium in communication with the processor, the computer-readable storage medium having computer-executable instructions stored thereon that, when executed by the processor, cause the computer to: obtaining activity data indicating a change in a number of members of a predetermined group; Determining that the change in the number of members of the predetermined group satisfies one or more criteria, wherein the change in the number of members of the predetermined group is determined to satisfy one or more criteria when: the number of members joining the predetermined group exceeds a threshold; or the number of members leaving the predetermined group exceeds a threshold; or The total number of members of the predetermined group exceeds a threshold; or The number of members who join the predetermined group within a predetermined time exceeds a threshold; or the rate of change of said number of members of said predetermined group exceeds a threshold or falls below said threshold; or a rate of change of said number of members of said predetermined group indicates an inflection point; or a rate at which members leave the predetermined group exceeds a rate threshold; In response to determining that the change in the number of members of the predetermined group satisfies one or more criteria, transmitting an update command to the client computer to replace the vault key with a new vault key, the update command causing the client computer to: encrypt secret data using a secret key to generate encrypted secret data, encrypt the secret key using the new vault key to generate an updated encrypted secret key*, encrypt the new vault key to generate an updated encrypted vault key; and The updated encrypted secret data, the updated encrypted secret key, and the updated encrypted vault key are received for storage in a vault associated with a user identifier and a group identifier.

5. The computer according to claim 4, wherein: The instructions further cause the computer to determine an age of the vault key, wherein the update command is also transmitted to the client computer in response to determining that the age exceeds an age threshold.

6. The computer according to claim 4, wherein: The instructions also cause the computer to determine an amount of secret data stored in association with the vault key, wherein the update command is also transmitted to the client computer in response to determining that the amount of secret data stored in association with the age of the vault key exceeds an amount threshold.

Images