Enhanced security for secret data of dynamic user groups

Abstract

A system can control access to encrypted data shared by a group of users by using a vault key associated with the group of users. The encrypted data can include encrypted secret data generated from a secret key using a secret key, an encrypted secret key generated from the secret key using a vault key, and an encrypted vault key generated from the vault key using a public key associated with a user in the group of users. The system can allow a user to store and access the encrypted data only if the user is a current member of the group. The system can verify the membership status of the user from a group manager of the system, such as an administrative channel or chat session.

Description

BACKGROUND

[0001] The resources required to manage systems that store secret data can present challenges to companies of all sizes. Human error or poorly managed maintenance tasks can lead to security issues if not properly managed. When a data center is serving a large user group, the management costs and exposure to various forms of risk can significantly increase. Security risks can further increase when such systems have a high user churn rate.

[0002] Additional challenges can arise when third-party entities are used to store secret data. For example, a particular company can use a third-party service to store secret data. While such a service can provide a higher level of security against certain types of threats compared to a self-managed turnkey system, there can be many drawbacks for a company that wishes to maintain a high level of security against malicious users or even the administrators of the third-party service.

[0003] It is with respect to these and other considerations that the present disclosure has been made. SUMMARY

[0004] The technology disclosed herein provides improved security for secret data shared among members of a group. Users can share secret data while they are members of a collaborative group activity, such as, but not limited to, a channel, chat session, meeting, or communication session. A system that stores the secret data can utilize individual vault keys associated with a particular group of users. When a user joins or leaves a group, like they can join or leave a channel or chat session, the system can utilize the individual vault keys to control access to the secret data shared by the group. In some configurations, individual vault keys can be associated with individual groups of users. For example, a system can provide a vault key for each channel created within an application such as MS Teams or Slack. The vault key can be used in a series of encryption steps that include encrypting secret data using a secure key, encrypting the secure key using a vault key, and encrypting the vault key using a public key associated with a user. The system can store the encrypted data in a vault and grant access to those users that are part of the group. Participants of a group can be authenticated by using authentication requests to a group management system such as MS Teams or Slack. By using the vault keys and by leveraging the benefits of a group management system, a storage system can mitigate the management overhead required to manage a system with a dynamic user group that includes a high user churn rate. The system can also improve security by only storing encrypted data that is generated on a remote client computer.

[0005] The technology disclosed herein separates "user authentication" and "access control" into two processes. In some configurations, the user authentication is delegated to a trusted service, such as Active Directory, to authenticate that a user is a member of a group and has full rights to the group. The group vault service obtains a dependency from the trusted authentication service before each member is granted access to the vault, and trusts the assurance from the authentication service that the requesting member is a valid member of the group and thus a valid member of the group vault to access the vault. In some aspects, a significant benefit of such technology is to provide the ability for a user to access a group vault from multiple devices associated with the authenticated user using a single vault key.

[0006] In some configurations, a system can receive encrypted data, including encrypted secret data, encrypted secret key, and encrypted vault key. The encrypted secret data can be generated from the secret data using the secret key. The encrypted secret key can be generated from the secret key using a vault key associated with a group of users. The system can receive or generate the encrypted vault key, which is generated from the vault key using a public key associated with a user in the group of users. The system can be configured to store the encrypted data only if the user is a current member of the group. The system can verify the membership status of the user from a group manager, such as a system that manages a channel or chat session. In response to verifying that the user is a current member of the group, the system can store the encrypted data in a storage vault associated with the group of users. The encrypted data can be shared with any member of the group. Each time a group member accesses the encrypted data, the system can verify the status of the user with respect to the group. The group manager can provide information about the membership status of each user, and also by permission definition for each member. Thus, the vault can provide specific read / write permissions based on the information received from the group manager.

[0007] It should be appreciated that the above-described subject matter can be implemented as a computer-controlled apparatus, a computer process, a computing system, or as an article of manufacture such as a computer-readable storage medium. These and various other features will be apparent from a reading of the following detailed description and a review of the associated drawings.

[0008] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the. This Summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to use the BRIEF DESCRIPTION OF DRAWINGS DETAILED DESCRIPTION

[0009] The detailed description is described with reference to the accompanying figures. In the figures, the left-most (or bottom-most) digit / digits of each reference numeral identifies the figure in which the reference numeral first appears. The use of the same reference numerals in different figures indicates similar or identical items. References to individual items of a plurality of items are by use of a reference numeral with a letter sequence in which the letter sequence distinguishes the individual items. Generic references to items of a plurality of items are by use of a reference numeral without a letter sequence.

[0010] Figure 1 is a block diagram illustrating several example components of a system for providing enhanced security for encrypted data using a vault key for a group of users.

[0011] Figure 2A is a block diagram illustrating stages of a process for storing encrypted data using a vault key for a group of users defined by a roster of a communication system.

[0012] Figure 2B is a block diagram illustrating a process for verifying membership of a particular group of users.

[0013] Figure 2C is a block diagram illustrating a state of a server for storing encrypted data using a vault key for a group of users.

[0014] Figure 2D is a block diagram illustrating stages of a process for requesting access to encrypted data stored using a vault key for a group of users.

[0015] Figure 2E is a block diagram illustrating a process for verifying membership of a particular group of users.

[0016] Figure 2F is a block diagram illustrating another stage of a process for requesting access to encrypted data stored using a vault key for a group of users.

[0017] Figure 2G is a block diagram illustrating a state of a plurality of client computers after accessing secret data from a server.

[0018] Figure 3Ais a block diagram illustrating aspects of a system for controlling access to stored data protected using a vault key for a group of users.

[0019] Figure 3B is a block diagram illustrating aspects of a process for controlling access to stored data protected using a vault key for a group of users.

[0020] Figure 3C is a block diagram illustrating aspects of a group manager for confirming membership in a group.

[0021] Figure 3D is a block diagram of other aspects of a process for controlling access to stored data protected using a vault key for a group of users.

[0022] Figure 3E is a block diagram illustrating results of a process of a client computer decrypting received data.

[0023] Figure 3F is a block diagram illustrating aspects of a client computer encrypting update data using a key combination including a vault key for a group of users.

[0024] Figure 3G is a block diagram illustrating a client computer providing update data to a server for storage.

[0025] Figure 3H is a block diagram illustrating a verification process of determining whether a user is a member of a group.

[0026] Figure 3I is a block diagram illustrating results of a server writing data to a vault in response to a user's membership verification.

[0027] Figure 4 is a flow diagram illustrating aspects of a process for obtaining a user private key.

[0028] Figure 5 is a flow diagram illustrating aspects of a process for obtaining a vault key from a vault service.

[0029] Figure 6 is a flow diagram illustrating aspects of a process for creating secret data in a personal vault.

[0030] Figure 7 is a flow diagram illustrating aspects of a process for creating secret data in a group vault.

[0031] Figure 8 is a flow diagram illustrating aspects of a process for sharing secret data from a personal vault to a group vault.

[0032] Figure 9 FIG. 1 is a flow diagram illustrating aspects of a process for updating secret data stored in a vault.

[0033] Figure 10 FIG. 2 is a flow diagram illustrating aspects of a process that allows a user to browse data stored in a vault.

[0034] Figure 11 FIG. 3 is a flow diagram illustrating aspects of a process for obtaining secret data from a vault service.

[0035] Figure 12 FIG. 4 is a flow diagram illustrating aspects of a process for adding a user to a group associated with a vault.

[0036] Figure 13 FIG. 5 is a process flow diagram illustrating aspects of a process for storing secret data in a vault and adding a user to a group associated with the vault.

[0037] Figure 14 FIG. 6 is a block diagram showing aspects of a process for obtaining activity data to control key updates for a group vault storage system.

[0038] Figure 15 FIG. 7 is a block diagram showing aspects of activity data that can be used to control key updates for a group vault storage system.

[0039] Figure 16A FIG. 8 is a block diagram showing aspects of a process for controlling key updates to be run by a plurality of client computing devices.

[0040] Figure 16B FIG. 9 is a block diagram showing aspects of a process for receiving data encrypted using an updated key.

[0041] Figure 17A Aspects of activity data having a first set of characteristics that cause a computing device to control one or more key updates are shown.

[0042] Figure 17B Aspects of activity data having a second set of characteristics that cause a computing device to control one or more key updates are shown.

[0043] Figure 17C Aspects of activity data having other characteristics that cause a computing device to control one or more key updates are shown.

[0044] Figure 18 FIG. 10 is a process flow diagram illustrating aspects of a process for updating one or more encryption keys based on activity of a user group.

[0045] Figure 19A is a block diagram illustrating aspects of a process for managing user permissions on a storage system based on membership data provided by a group management system.

[0046] Figure 19B aspects of a process for adding a second user to a group.

[0047] Figure 19C aspects of a process for transmitting membership data from a group manager to a storage server.

[0048] Figure 19D aspects of a process for sending an update command from a stored server to a client computer.

[0049] Figure 19E aspects of a process for transmitting an encryption key from a client computer to a server and / or a client computer of a new group member.

[0050] Figure 19F aspects of a process for a new member of a group to store encrypted data to a server.

[0051] Figure 19G aspects of a process for a new member of a group to store encrypted data on a server based on membership data received from a group manager.

[0052] Figure 20 is a process flow diagram illustrating aspects of a process for updating permissions for a user based on membership of a group.

[0053] Figure 21 is a computer architecture diagram illustrating an illustrative computer hardware and software architecture for a computing system that can implement aspects of the technology and art presented herein.

[0054] Figure 22 is a diagram of a distributed computing environment that can implement aspects of the technology and art presented herein.

[0055] Figure 23 is a computer architecture diagram illustrating a computing device architecture of a computing device that can implement aspects of the technology and art presented herein. DETAILED DESCRIPTION

[0056] The following detailed description pertains to techniques for providing enhanced security for encrypted data. In some configurations, a system is able to provide enhanced security for secret data shared by a group of users by using a single vault key associated with the group of individual users. As users dynamically join or leave a group, such as a chat session, a group meeting, a channel, or other form of communication session, the system is able to utilize individual vault keys to control access to secure data shared by the group. For example, a system can associate a vault key for each channel created within a user group collaboration application, such as MS Teams or Slack. The vault key can be used in a series of encryption steps that can allow a storage system to effectively control access to shared data for a group of users with a high turnover rate. As will be described in greater detail below, the use of vault keys associated with a group of users mitigates the administrative overhead conventionally required to manage access rights to protected data. Additional details of a storage system utilizing vault keys are described below and are illustrated in conjunction with Figures 1-13 Additional details of a management tool for adding users to a group are described below and are illustrated in conjunction with Figures 19A-20 Additional details of a management tool for adding users to a group are described below and are illustrated in conjunction with

[0057] The system is also able to provide enhanced security for encrypted data by using encryption key updates based on user group activity. Embodiments disclosed herein utilize a combination of vault keys and other security keys to control access to secret data shared by members of a group. The vault keys allow a system to control access to secret data by users that join a particular group while immediately limiting access from users that leave the group. Updates to the keys are initiated based on activity of members of the group, which can include, but is not limited to: a threshold change in the number of group members, a total number of group members, an amount of data shared among group members, and / or an age of one or more keys used to protect data shared by the group. Additional details regarding key updates are described below and are illustrated in conjunction with Figures 14-18 Additional details regarding key updates are described below and are illustrated in conjunction with

[0058] Although the subject matter described herein is presented in the general context of program modules that execute in conjunction with the operating system and application programs on the computer system, those skilled in the art will recognize that other implementations can be performed in combination with other types of program modules. Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that the subject matter described herein can be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like.

[0059] In the following detailed description, reference is made to the accompanying drawings, which form a part hereof, and in which are shown by way of illustration specific configurations or examples. Referring now to the drawings, in which like numerals represent like elements throughout the several figures, aspects of a computing system, computer-readable storage media, and computer-implemented methods for providing enhanced security for encrypted data are presented.

[0060] Figure 1 A system 100 that can be used to implement the technology disclosed herein is illustrated. The system 100 can include a group manager 115, a server 120, and N client devices 110. The server 120 can communicate with client devices 110, individually referred to as 110A-110N, each of which can be operated by a respective user 107, individually referred to as 107A-107N. The server 120 can manage one or more services for storing secret data received from the client devices 110. The secret data can be stored in association with a vault 109, which can include encrypted secret data 101', encrypted secret key 102', and encrypted vault key 104'. The vault 109 can be associated with a user group 111 having a group identifier 112 and a list of user identities 113 for each member of the group 111.

[0061] The server 120 can also communicate with a group manager 115 configured to manage collaborative sessions for individual groups 111 of users 107. For example, the group manager 115 (also referred to herein as a “group management system 115”) can manage communications between users of a group that are participating in a chat session, a channel, a meeting, a conference call, or any other collaborative exchange of data. Examples of features of the group manager can include features provided by Slack, Google Hangouts, or Microsoft Teams. Examples of entities that can provide features of the system 100 can include Amazon, Oracle, Salesforce, or Facebook. In some configurations, the group manager 115 can maintain a roster 116 of each group identified with a group identifier 112 and the identity 113 of each group member. Users can be added to or removed from a group 111 by a member of the group. In some configurations, some users can also independently control to add or remove themselves from a group. The server 120 can send a verification request 121 to the group manager 115, and in response to the request, the group manager 115 can send a confirmation 122 to the server 120 to verify whether a particular user 107 or group of people is a part of a group 111. The group manager 115 can also send roster data to the server 120 without a request from the server 120.

[0062] The system 100 enables users of a group to share secret data with other members of the group. Access to the secret data stored on the server 120 is based on the membership status of a user in a particular group associated with the secret data. Thus, when a user joins a particular group, the group member can gain access, e.g., read and / or write permissions, to the secret data stored in association with that group. When a user leaves the group, the server 120 can communicate with the group manager 115 to verify the status of each member. When a user is verified to have left a group, the server 120 can restrict access and prevent the user from accessing secret data stored on the server 120 in association with that group, e.g., read and / or write.

[0063] To store secret data within the vault 109, each group member can encrypt the secret data 101 using the secret key 102 on the client device 110 to generate encrypted data 101'. In some configurations, the secret key 102 can include a symmetric key. Each group member can also encrypt the secret key 102 with the vault key 104 to generate an encrypted secret key 102'. Additionally, each group member can also encrypt the vault key 104 using a public key from a public-private key pair to generate an encrypted vault key 104'. Each user can then transmit their respective encrypted data 101', encrypted secret key 102', and encrypted vault key 104' to the server 120 for storage in the vault 109. When a user wishes to retrieve the stored data, each user can decrypt the encrypted vault key 104' by using the corresponding private key of their public-private key pair to obtain the vault key 104. Each user can then use the vault key 104 to access the secret key 102 and ultimately the secret data 101.

[0064] For illustrative purposes, a "vault" can include a data store dedicated to storing information shared by a particular group of users. Access to the vault is based on a roster of members that can be verified by a trusted resource such as the group manager 115. Access to the vault can be granted to multiple users that are currently participating in the group. The group manager can grant access by transmitting each user's identity to a system that manages the vault, such as Google Drive, OneDrive, iCloud, etc. The vault can be constructed as an autonomous data store independent of other vaults. Thus, a user that is a member of a group with access to a first vault is not granted access to read data from or write data to a second vault associated with another group. The data stored in each vault can include encrypted secret data and encrypted security keys. In some configurations, the vault key 104 can be generated by the server 120 and transmitted to each client device associated with a member of a particular group. In other configurations, the client device 110 can be used to generate the vault key 104.

[0065] In some configurations, the technology disclosed herein can separate user authentication and access control into two unique processes, and each process can be performed by two entities. For example, access to the data in the vault can be managed by a first entity, e.g., Google Drive, Amazon Web Services (AWS), Oracle Cloud, Salesforce Service Cloud, Facebook Cloud, etc. The group vault service has a dependency relationship and can benefit from such a trusted authentication service and trust the verification from the authentication service regarding a requesting member’s access to the vault. The process of determining whether a person is a current member of a group can be managed by a second entity, e.g., Slack, Microsoft Teams, etc.

[0066] Reference is now made to Figures 2A-2G Aspects of a process for storing encrypted data using a vault key for a group of users are shown and described below. In this example, each user is a member of a group 111 associated with a vault 109. Figure 2A An example of users generating encrypted data with corresponding client devices 110A-110N is illustrated. For example, a first user 107A generates encrypted secret data 1 101A' using secret data 1 101A with secret key 1 102A with a first client device 110A. The first client device 110A can encrypt the secret key 1 102A using a vault key 104 associated with the group 111, generating encrypted secret key 1 102A'. Additionally, the first client device 110A can encrypt the vault key 104 using a public key 1 105A from a first public-private key pair associated with the first user, generating encrypted vault key 1 104A'. Other client devices 110B-110N associated with other users 107B-107N can generate other encrypted data using similar processes with their respective public-private key pairs, e.g., encrypted data 2 101B', encrypted secret key 2 102B', encrypted vault key 2 104B', encrypted data N 101N', encrypted secret key N 102N', and encrypted vault key N 104N'. The encrypted data can then be transmitted to a server 120 for storage in the vault 109.

[0067] As in Figure 2BAs shown in the middle, in response to receiving the encrypted data, or in response to receiving a request (also referred to herein as a "write request") to store the encrypted data in the vault 109 associated with the group 111, the server 120 determines whether each user requesting storage of the encrypted data is a member of the group 111. In one illustrative example, the server 120 can send a verification request 121 to the group manager 115 to verify the membership status of each requesting user. In response to the verification request 121, the group manager 115 can access records, such as the group roster 116 defining the members of each group, to determine whether one or more users are current members of the group. The individual records can indicate the group ID 112 and the user ID 113 for each member. The individual records can also indicate the specific permissions and roles for each user ID. Thus, in response to the verification request 121, the group manager 115 can respond by sending an acknowledgement 122 back to the server 120. In this example, the acknowledgement 122 indicates that the first user 107A (user 1) is still a member of the group (group 1), the second user (user 2) is still a member of the group (group 1), and the Nth user (user N) is still a member of the group (group 1).

[0068] The verification request 121 can be in a variety of different forms. In one example, the verification request 121 can include a group ID 112. In response to such a request, the group manager 115 can send an acknowledgement 122 including a list of all members of the group. In another example, the verification request 121 can include a group ID 112 with a plurality of user IDs 113. In response to such a request, the group manager 115 can send an acknowledgement 122 including the specific user IDs 113 indicated in the request 121 with an indication of their membership status, e.g., current member, not a member, not a member at a specific date and time, etc.

[0069] In yet another example, a request for verification 121 can include the group ID 112, the plurality of user IDs 113, and other metadata indicating a request for verification of one or more permissions. In response to such a request, the group manager 115 can send an acknowledgement 122 including the group ID, the particular user IDs 113 of the current members, and one or more permissions associated with each user ID 113. The permissions can indicate an access level or role for each user, e.g., administrator privileges versus regular user privileges. The permissions can also indicate specific access permissions, e.g., read and / or write permissions. In other embodiments, the permissions can also indicate specific access permissions, e.g., read and / or write permissions, that apply to individual files or groups of files. Based on the permissions defined in the acknowledgement 122, the server 120 can determine whether each user can write data to the vault 109.

[0070] As shown in Figure 2C For each individual that is a member of the group associated with the vault, the server 120 can store the received encrypted data in the vault 109 in association with the particular group 111, e.g., each user is part of a chat session or channel managed by the group manager 115. In some configurations, the server 120 can associate the vault 109 with the group ID 112, and the server 120 can associate the group ID 112 with individual user IDs 113A-113N for each member of the group 111. Users that are not current members of the group, e.g., are no longer part of the chat session or channel, are restricted from writing data to the vault. Thus, in the example shown in Figure 2B If the acknowledgement 122 indicates that user 2 is not part of the group 111, the server will deny user 2 from storing data in the vault 109. Thus, in such an example, the server 120 will not store the encrypted data 2 101B', the encrypted secret key 2 102B', the encrypted vault key 2 104B' in the vault in response to determining that user 2 is not part of the group 111.

[0071] Once the encrypted data is stored in the vault, any current member of the group can access the encrypted data stored in the vault. Figure 2DAspects of a process in which users request access to encrypted data stored in a vault for a particular group of users 111 are shown. In this example, to illustrate aspects of how data can be shared among group members, a first user 107A sends an access request 124 to request a copy of encrypted data 2 102B', e.g., the secret data originally stored by a second user 107B using a second computing device 110B. At the same time, in this example, the second user 107B sends an access request 124 to request a copy of encrypted data 1 102A', e.g., the secret data originally stored by the first user 107A using a first computing device 110A. Likewise, in this example, a user 107N sends an access request 124 to request a copy of encrypted data N 102N', e.g., the secret data originally stored by the user at the server 120.

[0072] In response to the access requests 124, as shown in Figure 2E the server 120 can determine whether each requesting user is still a member of the group. In one illustrative example, the server 120 can send a verification request 121 to the group manager 115 to verify the membership status of each requesting user. In response to the verification request 121, the group manager 115 can access records, such as a group roster 116 that defines the members of each group. Individual records can indicate the group ID 112 and user ID for each member. Individual records can also indicate the specific permissions and roles for each user ID. Thus, in response to the verification request 121, the group manager 115 can respond by sending an acknowledgement 122 back to the server 120. In this example, the acknowledgement 122 indicates that the first user 107A (user 1) is still a member of the group (group 1), the second user (user 2) is still a member of the group (group 1), and the Nth user (user N) is still a member of the group.

[0073] Referring to Figure 2FSince the confirmations 122 indicate that each of the requesting users is a current member of the group, the server 120 transmits the requested data to each of the client devices 110. In particular, the server 120 transmits the encrypted vault key 1 104A', the encrypted data 2 101B', and the encrypted secret key 2 102B' to the first client device 110A. The server 120 also transmits the encrypted vault key 2 104B', the encrypted data 1 101A', and the encrypted secret key 1 102A' to the second client device 110B, and the encrypted vault key N 104N', the encrypted data N 101N', and the encrypted secret key N 102N' to the Nth client device 110N. As shown, in response to the access request, each requesting user receives the encrypted data 101' and the encrypted secret key 102' that it requested, as well as the encrypted vault key 104' associated with its public-private key pair used to encrypt the vault key 104.

[0074] As shown in Figure 2G , each client device 110 is able to decrypt the received data using the private key 106 corresponding to the public key each user used to encrypt the vault key 104. In particular, the first user 107A uses the first client device 110A to decrypt the encrypted vault key 1 104A' using the first user's private key (User 1 Private Key 106A) to produce the vault key 104. The first client device 110A is then able to use the vault key 104 to decrypt the encrypted secret key 2 102B' to produce the secret key 2 102B. The first client device 110A is then able to use the secret key 2 102B to decrypt the encrypted data 2 101B' to produce the encrypted data 2 101B. The other client devices 110B-110N associated with the other users 107B-107N are able to decrypt the other received data in a similar manner. As shown, the system 100 allows members of a group to share and retrieve secret data while they are members of the group.

[0075] Referring now to Figures 3A-3G , another user scenario is shown and described below. This example illustrates how the system 100 can be used to limit access to members that are not or are no longer part of a group. Also, this example shows how the system 100 can be used to allow users to update stored data. As shown in Figure 3A , it is assumed that each client device 110 begins with a private key 106 prior to sending an access request.

[0076] Figure 3BAspects of access requests 124 are shown. In this example, first user 107A sends an access request 124 to request a copy of encrypted data 2 102B', e.g., the secret data originally stored by second user 107B using second computing device 110B. Second user 107B sends an access request 124 to request a copy of encrypted data 1 102A', e.g., the secret data originally stored by first user 107A using first computing device 110A. Likewise, similar to the previous example, user 107N sends an access request 124 to request a copy of encrypted data N 102N', e.g., the secret data originally stored by the user at server 120.

[0077] In response to access requests 124, as shown in Figure 3C , server 120 determines whether each requesting user is a member of the group by using verification requests 121. In this example, second user 107B has been removed from the roster of the group, as indicated by data stored at group manager 115. Thus, in response to verification requests 121, group manager 115 responds by sending acknowledgements 122 back to server 120 indicating that first user 107A (user 1) and Nth user (user N) are still members of the group (group 1), while second user (user 2) is no longer a member of the group (group 1).

[0078] As shown in Figure 3D , server 120 responds to the acknowledgements 122 by allowing the communication of encrypted data to first user 107A and Nth user 107N, while restricting access by second user 107B. In such embodiments, server 120 can send a notification to a client such as second client 110B, where the notification can indicate the status of the access request. The notification can indicate the status of the user of the group, or provide a message indicating that the requested data is not available. As shown in Figure 3E , the client devices of first user 107A and Nth user 107N can then utilize the corresponding private keys 106 to decrypt the received data using the techniques disclosed herein.

[0079] As outlined herein, the techniques disclosed herein allow users to update encrypted data stored in a vault. Aspects of this process are shown in Figures 3F-3I . As shown in Figure 3FAs shown, the Nth client device 110N can generate updated data 141N. Then, the Nth client device 110N can encrypt the updated data 141N using a secret key 102N, and then encrypt the secret key 102N using a vault key 104. The vault key can then be encrypted using the user's public key 105N. (As shown in...) Figure 3G As shown, the Nth device 110N is then able to transmit the updated encrypted data 141N' to the server 120. In response to receiving the encrypted data, as in... Figure 3H As shown, server 120 is able to verify a user's membership status relative to the group. In this example, group manager 115 confirms that the user is currently a member of the group. In response to this confirmation, as in Figure 3I As shown, server 120 stores the updated encrypted data 141N' in vault 109. If the confirmation from group manager 115 indicates that user N 107N is not a current member of the group, or if user N 107N has restricted write permissions, server 120 is able to reject any request from that user regarding writing data to vault 109.

[0080] exist Figures 3F-3I In one example, the user can also provide updated encrypted secret data encrypted with the new secret key. In such an embodiment, the client device will also provide an updated encrypted secret key encrypted with the vault key. Alternatively, the user can also provide an updated encrypted vault key encrypted with the new public key from the new key pair. This encrypted data provided by the client can be stored in the vault after verifying the user's membership in the group or after verifying the user's write permission to the vault from the group manager.

[0081] In the examples provided herein, it is apparent that encrypted vault keys (including encrypted vault keys updated with a new public key) can be generated at server 120. In such embodiments, instead of transmitting the encrypted vault key from the client to the server, the client can transmit the public key to server 120, allowing server 120 or another computer to generate encrypted vault keys using any received public key.

[0082] Figure 4A process for obtaining a user's private key is illustrated. At login, the client 110, operated by a user 107 such as the first user 107A, can attempt to obtain the private key from a resource such as the OS secure storage 130. If this is the first time the client 110 is being used or if the private key has been removed from the OS secure storage 130, the client 110 can obtain the user's private key from the key directory service 140. The key directory service can include a data store of secure keys that can be accessed by users with the appropriate credentials. If the key directory service 140 does not have a key bundle, an error is returned to the client 110. The error indicates that this is the first time the user 107 has logged in. Thus, the task of the client 110 is to generate a public / private key pair and the operation of uploading it. If the client 110 has only uploaded the public key, then the system will have to find a way to share the private key between each client that the user logs into. In some configurations, the system can encrypt the private key with a symmetric key, which can be much smaller in size and obtain equal security. The client 110 can also encrypt the private key and send it to a remote computer, and then, when the client is first used, share only the client key between clients, such as a 128-bit symmetric encrypted key. As in other descriptions herein, any encrypted data is denoted by the use of an apostrophe, e.g., vault key 104', indicating an encrypted vault key.

[0083] If the private key exists in the directory service 140, it is downloaded to the client 110, and the system can attempt to get the client key from the OS secure storage 130. If the client key does not exist, the client 110 can prompt the user to provide one, as this is not the first use scenario, but the first time simply preparing the client application.

[0084] With respect to the storage of a user's private key, a variety of different techniques can be used to manage the storage. As described above, in some configurations, the private key can be stored in a key directory service. However, when a user wishes to access their stored secrets using multiple devices, the user can encrypt the private key and then share that private key with other devices. As outlined herein, the user must have the private key to properly decrypt a secret received from the vault. However, to access the private key, it needs to be shared between devices belonging to a single user. To this end, one of the client devices can encrypt the private key using a symmetric key (e.g., AES-128) and upload the encrypted private key to the key directory service, so that the size of the data that needs to be shared between devices (only 128 bits) is significantly smaller than the private key.

[0085] The symmetric key can be saved to an operating system (OS) secure storage and only retrieved when needed to be transferred to a new device. When a new client is prepared, the private key can be retrieved from the key directory service and then saved to the OS secure storage for future use.

[0086] Transferring a client key, such as a 128-bit shared client key, can be a one-time event for each new client. There are several embodiments for transferring a client key. For example, when both a device that has already been prepared and a new device are connected to the Internet, a user can initiate a secure transfer process between the devices using a regular secure messaging method, where each device creates its own public and private key pair. In another embodiment, a user can create a quick response (QR) code and display it on one device for the new device to capture and enroll. In another embodiment, a device can display a string of characters that the user types into another device. The user can also print the string of characters and save it in a secure place so that the user does not need to access the old device.

[0087] In some embodiments, the client computer 110 can perform a process for sharing a single key with multiple devices for a single user. The client computer 110 can encrypt a private key of a private-public key pair using a symmetric key to generate an encrypted private key. The client computer can then communicate the symmetric key to a secure service running on a remote device, where the secure service provides access to the symmetric key by using one or more credentials associated with the first user. The process can also include communicating the encrypted private key to a secure storage 130 associated with an operating system of one or more computing devices, where the encrypted private key is protected using one or more credentials associated with the first user. The one or more computing devices can include the client device 110, the server 120, or another computer accessible to the first user. It can be appreciated that the client operating system secure storage 130, the key service 140, and / or the client secure service 131 can reside on any suitable computing device, including but not limited to the client device 110, the server 120, or any other remote device accessible to the user, such as the first user 107A.

[0088] Figure 5FIGURE 8 illustrates a process for obtaining a vault key for a particular vault. When a vault key is requested, the vault service (e.g., server 120) will return a vault key encrypted with the user's public token. In some configurations, the user's token is an access token obtained by the client when the user logs in with their credentials, which can include a Microsoft Account (MSA) or Azure Active Directory account (AAD) credential. The token contains the user's ID and, when verified, can be trusted to represent the user's consent to take an action. If the vault has not already been prepared, the vault service 129 can return an error and the vault SDK can generate a key, such as an AES-256 key, and encrypt it for each of the members of the group. Timing can affect the process. For example, when the client 110 requests to create a vault, the vault service (e.g., server 120) can create the vault or, if another client created the vault, the server will return the encrypted vault key for the requester.

[0089] This example is provided for illustrative purposes and should not be construed as limiting. It can be appreciated that each system (including server 120 or group manager 115 (e.g., chat service 115)) can utilize one or more techniques to authenticate users on each system, e.g., each system can use a different authentication service and / or different credentials for each user. In some configurations, server 120 can utilize an authentication process that is independent of group manager 115. Alternatively, server 120 can utilize an authentication process that is coordinated with group manager 115, e.g., each system can use the same authentication service or each user's credentials. In some configurations, the group manager can not utilize credentials for certain group members, particularly in configurations where users can join a group anonymously.

[0090] For illustrative purposes, a personal vault can simply include a group with a single member, and the rest of the logic unit and selection portion that shares the data. The vault ID for a personal vault is the user ID, while the vault ID for a group vault can be the thread ID of the group communication session. When the vault is not yet prepared, the client 110 can poll the group manager 115 (e.g., chat service) to request the membership roster in the case of a group, or set the membership roster to the ID of the current user in the case of a personal vault. In either case, the client 110 can then iterate through the membership roster and encrypt the vault key using the public key of each member. A tuple set of user ID, vault ID, and encrypted vault key (encrypted vault key') is then sent to the vault service 120 to create the vault. If the vault does not yet exist, the vault service 120 can store the data to a storage resource associated with the user, e.g., a personal storage device or service. In the following figures, it can be assumed that the vault is already prepared for illustrative purposes when a request is made for a vault key.

[0091] Figure 6 A process for creating a secret in a personal vault is illustrated. In this example, the secret is encrypted using symmetric encryption, such as AES-256, and the encrypted secret is content that is persisted to storage, such as the vault service 120. In some configurations, each secret can have its own unique secret key. The secret key can not be kept on the client 110, but is encrypted using the vault key, and the user only needs to access the encrypted vault key using its public key to be able to read the chain all the way back to the secret. In this way, a personal vault is no different than a group vault. In this example, if the secret is less than a predetermined threshold, such as two megabytes, the vault service 120 can communicate the secret ID and secret metadata to a first resource for secrets 151. If the secret is above the threshold, or the secret cannot fit in the database, the vault service 120 can communicate the secret ID and encrypted secret to a second resource for large secrets 152. In some configurations, the vault service 120 can communicate the vault ID, secret ID, and encrypted secret key (encrypted secret key') to a third resource (one or more vaults 153).

[0092] Figure 7Figure illustrates the process of creating a secret in a group vault. This example involves a first user 107A (Annika) who wants to share a secret (e.g., secret data) with a second user 107B (Bo). When Annika wants to share the secret with Bo, she encrypts the secret using a secret key, which can be a 256-bit secret key, to generate an encrypted secret. Annika also encrypts the secret key using the vault key for the vault she shares, and sends the encrypted secret and encrypted secret key to the vault service 120. As with Figure 6 This example differs from the example of Figure 1 in that the vault key is sent in association with a thread ID of a group, rather than a user ID.

[0093] Figure 8 Figure illustrates the process for sharing a secret from a personal vault to a group vault. Generally, there are few restrictions when sharing secrets between vaults. In some configurations, a secret can be shared from a personal vault to a group vault. Sharing a secret from a personal vault to a group vault can involve adding an additional record in the vault storage, but this can require the secret key. Since the server can not store unencrypted keys, the client computer 110 can open the encrypted secret key using his or her private key of the personal vault, and then re-encrypt it using the key of the group vault. At the client 110, the secret ID can be obtained, as well as the source vault ID and the destination vault ID. Such information can be provided by the user 107 or any other computing resource. This data is then shared with the vault service 120 that verifies the user token. This verification process can involve sending a query to the group manager, such as a chat service, and receiving a verification from the group manager that the user is a member of a particular group. The server 120 can return the encrypted source vault key, the encrypted secret key for the source vault, and the encrypted destination vault key encrypted using the public key of the user 107. The client 110 can request the private key from the client OS secure storage 130.

[0094] The client 110 can then use the private key to decrypt the source vault key, use the source vault key to decrypt the secret key for the source, and encrypt the secret key using the destination vault key. The client 110 can then share the secret with the vault service 120 by sharing the destination vault ID, the secret ID, and the encrypted secret key for the destination vault (“secret key 'destination”). The vault service 120 can then add the secret ID, secret key 'destination entry to the vault for the destination vault ID.

[0095] Figure 9A process for updating secrets is illustrated. In some configurations, a user can only update secrets that he or she owns. A user owns a secret if he or she is a member of a group identified by a thread ID that owns a vault for a shared vault, or if the secret is in his or her personal vault. In such embodiments, both the client 110 and the server 120 can be configured to enforce this constraint.

[0096] When Annika wants to change the contents of a secret that she owns, she simply replaces the secret with a new secret encrypted using the same secret key. To obtain the key for encrypting the new secret, she must follow the procedure to retrieve the secret. Since the change is limited to the actual payload, there is no need to update the encrypted secret key for Bo.

[0097] Figure 10 An exemplary process for allowing a user to browse a vault is illustrated. Generally, the client 110 can receive updates to secret metadata by requesting all secret metadata changes since a given timestamp. The timestamp can come from the last time the vault service received data, e.g., the last observed time. In response to the request, the vault service 120 can iterate through the user's vault and each vault secret in the vault secret. The vault service 120 can then return the secret metadata and secret ID for each secret. The return value returns the current timestamp, which can then be stored and used the next time a request is made. Sorting or filtering the secrets can be performed by the client 110. In some embodiments, the client 110 can use filters by type or by vault. The secret metadata can provide a summary of the secret data, the owner of the secret data, a description of the owner of the secret data, etc.

[0098] Figure 11 An exemplary process for obtaining a secret is illustrated. Generally, when a user has identified a secret of interest by reading the metadata, the secret can be requested from the vault service. In some embodiments, the metadata can include a summary of the secret, the associated key, or any other information related to or indicative of the secret. In some embodiments, the metadata can include a timestamp, a description of the user's activity, etc.

[0099] In Figure 11The process illustrated in FIG. 6 can include operations for receiving a secret ID to be updated and receiving an identifier of a vault containing the secret (e.g., a vault ID). The secret ID and vault ID can be transmitted to the vault service 120 within the request. In response, the vault service 120 verifies that the user is a member of the group. This process can involve communication with a group manager such as Slack, MS Teams, etc. The vault service 120 can respond to the request by delivering an encrypted vault key and an encrypted secret key that can be encrypted using the user’s public key. In some configurations, the client 110 can send a request to the client OS secure storage 130 to request the permanently stored private key. In response to receiving the private key, the client 110 can decrypt the encrypted vault key using the user’s private key and decrypt the encrypted key using the vault key. The system can also decrypt the encrypted secret using the secret key, thereby generating the secret data.

[0100] Figure 12 A process for allowing a user to add someone from the directory to a group is illustrated. When a user adds a new member to a group, the new member will need a vault key encrypted with their public token so that they can decrypt the secret. The vault service has no data about the vault key, so the vault service cannot automatically provide the key to the new member. The user who is adding the new member can obtain the vault key, so as part of adding the new member to the group, one or more clients 110 can also add the new member to the vault.

[0101] The process begins when a client requests a private key for a particular user, such as a first user. The client 110 can look up a second user in the directory and obtain the user ID of the second user. The client 110 can also obtain a vault ID and encrypt one or more secrets using a secret key. The client 110 can send a request to the vault service 120 to obtain an encrypted vault key that can be encrypted using the first user public key. The public key for the new user (e.g., the second user) can be obtained by the client through one or more resources such as the key service 140. The client 110 can then decrypt the encrypted vault key using the first user’s private key. The client 110 can then encrypt the vault key using the second user’s public key. The client 110 can then transmit the encrypted vault key encrypted by the second user public key to the vault service 120. In such a communication, the client 110 can also transmit the vault ID, the user ID of the second user, and the encrypted vault key. In response, the vault service 120 can add an entry to the user table.

[0102] Turning now toFigure 13 The following shows and describes aspects of routine 900 for providing enhanced security for encrypted data. It should be understood that the operations of the methods disclosed herein are not necessarily presented in any particular order, and it is possible and contemplated to perform some or all of the operations in one or more alternative orders. For ease of description and illustration, the operations have been presented in the order of demonstration. Operations may be added, omitted, and / or performed simultaneously without departing from the scope of the appended claims.

[0103] It should also be understood that the illustrated method can end at any time and does not need to be fully executed. Some or all of the operations and / or substantially equivalent operations of the method can be performed by executing computer-readable instructions contained on a computer storage medium, as defined below. As used in the specification and claims, the term "computer-readable instructions" and variations thereof are used broadly herein to include routines, applications, application modules, program modules, programs, components, data structures, algorithms, etc. Computer-readable instructions can be implemented on a variety of system configurations, including single-processor or multi-processor systems, minicomputers, mainframe computers, personal computers, handheld computing devices, microprocessor-based programmable consumer electronics, combinations thereof, etc.

[0104] Therefore, it should be recognized that the logical operations described herein are implemented as: (1) a sequence of computer-implemented actions or program modules running on a computing system, and / or (2) interconnected machine logic circuits or circuit modules within the computing system. The implementation method is a matter of choice depending on the performance and other requirements of the computing system. Therefore, the logical operations described herein are referred to differently as states, operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules can be implemented using software, firmware, dedicated digital logic, and any combination thereof.

[0105] As will be described in more detail below with reference to other accompanying drawings, the operation of routine 900 is described herein as being implemented at least in part by an application such as program module 623 of Figure 19, which is also referred to herein as one or more program modules. Although the following description refers to program module 623, it will be appreciated that the operation of routine 900, or any other process, method, or operation disclosed herein, can be implemented in many other ways. For example, routine 900 can be implemented as part of an operating system or as part of any other application. Furthermore, it will be appreciated that the implementation of system 100 can include... Figure 1More or fewer computing devices than those shown in FIG. 1 can be used. For example, each of the software components and modules described above can be implemented in a single computing device configured with the same features. In other scenarios, some of those can include using a server farm, any number of computing devices can be used to implement the features and techniques described herein.

[0106] Referring to Figure 13 The routine 900 begins at operation 901 where the program module 623 receives encrypted secret data 101 A' generated from the secret data 101 A using the secret key 102A. In some configurations, the encrypted secret data 101 A' is generated on a remote computer, such as the client device 110, and transmitted to a computer running the program module 623, such as the server 120.

[0107] At operation 903, the program module 623 receives an encrypted secret key 102A' generated from the secret key 102A using a vault key 104 associated with the group 111 of users 107. In some configurations, the encrypted secret key 102A' is generated on a remote computer, such as the client device 110, and transmitted to a computer running the program module 623, such as the server 120.

[0108] At operation 905, the program module 623 receives an encrypted vault key 104' generated from the vault key 104 using a public key 105A associated with a first user 107A of the group 111 of users 107. In some configurations, the encrypted vault key 104' is generated on a remote computer, such as the client device 110, and transmitted to a computer running the program module 623, such as the server 120.

[0109] At operation 907, the program module 623 sends a verification request to the group manager 115 to verify whether one or more users are current members of the group 111. In some configurations, the verification request can include a group ID and at least one user ID, such as the first user 107A. The verification request can be sent to the group manager 115, which manages a service such as Slack, Google Hangouts, or Microsoft Teams.

[0110] Next, at operation 909, the program modules 623 receive a confirmation from the group manager 115 indicating the membership status of one or more users. In one illustrative example, the confirmation can include a membership status of a group ID and at least one user ID, e.g., the first user 107A is a current member, or the first user 107A is not a current member. The confirmation can also include one or more permissions for each user. For example, the confirmation (also referred to herein as a group confirmation 122) can include a user ID and indicate whether that user ID is associated with a read and / or write permission. The confirmation can also describe a role or other attribute associated with an individual user ID. In one illustrative example, with reference to Figure 1 , the computing device can receive a group confirmation 122 from the group management system 115, and the group confirmation 122 can indicate the status of the first user 107 and one or more group identifiers 112.

[0111] Next, at operation 911, in response to receiving a group confirmation 112 indicating that a user, such as the first user 107A, is associated with a particular group, the routine 900 proceeds to operation 913, where the program modules 623 can take a number of actions to allow the transfer and / or storage of the encrypted data, e.g., the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104'. However, if the group confirmation 112 indicates that a user, such as the first user 107A, is not associated with a particular group, the routine 900 proceeds to operation 914, where the program modules 623 can take a number of actions to restrict the transfer and / or storage of the encrypted data, e.g., the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104'.

[0112] Referring now to Figures 14-18 Techniques for controlling updates to encrypted keys of the system 100 are shown and described in greater detail below. Generally speaking, updates to one or more encryption keys are invoked when one or more criteria are met with respect to a particular type of activity of a group of users. For example, the system 100 can cause one or more client computers to update to one or more keys when the size of a group of users exceeds or falls below one or more thresholds. The system 100 can cause one or more client computers to update to one or more keys when a churn rate exceeds or falls below one or more thresholds. The system 100 can cause one or more client computers to update to one or more keys when the system detects that one or more keys exceed an age threshold. The system 100 can cause one or more client computers to update to one or more keys when stored data or data usage exceeds or falls below one or more thresholds. For illustrative purposes, Figures 14-18Aspects of a process for managing updates to one or more encryption keys based on user activity of a group vault storage system are shown.

[0113] As shown in Figure 14 The group manager 115 can maintain a membership roster 901 listing the identities 113 of members of a user group 111. Individual membership rosters 901 can list users participating in a communication session, such as a channel, chat session, meeting, or any other collaborative group activity for exchanging information. Users can be added or removed from a particular roster by joining or leaving a group, such as a channel, meeting, etc. In some configurations, the group manager 115 can transmit instances of the membership roster 901, or update the membership roster 901 to the server 120. Over time, the server 120 can collect and analyze multiple membership rosters 901 to detect one or more predetermined patterns of user activity.

[0114] As shown in Figure 15 The server 120 can generate activity data 902 based on analysis of one or more membership rosters 901 received over time to determine a variety of different types of performance metrics. The performance metrics can include user churn measurements, such as the number of users that have joined or left a group, the total number of group members, fluctuations in churn rate, etc. The server 120 can also measure data usage parameters for individual groups, such as the amount of data shared by a group, fluctuations in the amount of data shared by a group, etc. Additionally, the server 120 can measure different parameters with respect to the age of one or more encryption keys associated with a vault or group of users, such as the age of a vault key, the age of a secret key, and / or the age of a public and private key pair. Combinations of performance metrics can also be measured, such as the amount of data shared by a group and the age of a particular key, the amount of user churn measured for a group and the age of a particular key, the amount of data shared by a group and the number of users that have joined or left a group, etc.

[0115] In the example of Figure 15 When one or more of the measurements fall below one or more thresholds, e.g., a churn threshold 903, a data activity threshold 905, and / or a key age threshold 906, the system can continue to monitor the activity data 902 without sending any update commands for updating one or more keys at the client device 110. However, as shown in Figure 16A When one or more of the measurements exceeds the one or more thresholds, the server 120 can transmit one or more update commands 1310 to the client device 110. In response to the update commands 1310, as shown in Figure 16BAs shown in FIG. 13, the client devices 110 can replace any existing key or any combination of existing keys with the new key. For example, the update command 1310 can cause the client devices 110 to update a secret key and / or a private-public key pair. In some configurations, a vault key for a particular group can be generated at the server 120 and transmitted to the client devices 110. In some configurations, a vault key can be generated at the client devices 110 in response to receiving the update command 1310. In such embodiments, one client device can generate the vault key, while other devices will receive a copy of the newly generated vault key via the server 120.

[0116] In some configurations, a single client device or a selected group of client devices can be selected to update one or more keys. The selection of the device(s) to update the one or more keys can be based on the role or permissions for each member, the activity of a particular client device, and / or the hardware capabilities of a particular client device. For example, if a user is a designated administrator for a group, the user and / or the user's corresponding device can be selected to update one or more keys. In some configurations, the client devices can communicate with each other and / or with the server on a peer-to-peer basis to determine which device(s) will update the one or more keys. The devices can be selected based on the activity of the devices and / or one or more capabilities of the individual devices. For example, if it is determined that a particular computing device remains online for a period of time relative to other devices in the pool of devices, the particular computing device can be selected to update one or more keys. In another example, if it is determined that a particular computing device has an architecture that is more efficient at updating one or more keys or encrypting data, e.g., a desktop with a particular processor as compared to a mobile device with a low power processor, the particular computing device can be selected among a pool of other candidate devices.

[0117] In Figure 16BIn the example shown, update command 1310 causes each client device to update all keys for that client device. For illustrative purposes, asterisks indicate new keys, and apostrophes indicate encrypted data. For example, first device 110A can replace vault key 104A and secret key 102A with a new vault key 104A* and a new secret key 102A*. Update command 1310 can also cause first client device 110A to encrypt secret data 101A using the new secret key 102A* to generate updated encrypted secret data 101A'*. Update command 1310 can also cause first client device 110A to encrypt new secret key 102A* using the new vault key 104A* to generate updated encrypted secret key 102A'*. Update command 1310 also enables the first client device 110A to use the new public key 105A* to encrypt the new vault key 104A* to generate the updated encrypted vault key 104A'*.

[0118] This example is provided for illustrative purposes and should not be construed as restrictive. It will be appreciated that any combination of encryption keys can be replaced with a new encryption key, and in some embodiments, the client device can use any existing key in the aforementioned process. For example, update command 1310 enables a first client device 110A to encrypt a new vault key 104A* using the existing public key 105A to generate an updated encrypted vault key 104A'*.

[0119] Once client device 110 generates updated keys and newly encrypted data, such as updated encrypted secret data 101A'*, updated encrypted secret key 102A'*, and updated encrypted vault key 104A'*, the new encrypted data can be transmitted to server 120 for storage in vault 109 associated with group identifier 112, and ultimately for storing multiple user identities 113 associated with group 111. This process can also be repeated for each client device 110 associated with a user 107 who is a member of group 109.

[0120] Figures 17A-17C Several exemplary scenarios are illustrated, in which a specific pattern of user activity 1302 leads to the updating of one or more encryption keys to the vault storage system. Figure 17A In the first example shown, the roster trend displays the number of members leaving the group over time. In this example, multiple measurements were taken within a time period. When a measurement result (such as the measurement result at the fifth sample) exceeds a threshold 1303, server 120 is able to send an update command, causing one or more client devices to update one or more encryption keys stored on server 120.Figure 17A In a second example shown in FIG. 13B, the roster trend shows the total number of group members over time. In this example, multiple measurements are taken over a time period. When a measurement, e.g., the measurement at the fourth sample, exceeds a threshold 1303, the server 120 can transmit an update command so that one or more client devices update one or more encryption keys for storage on the server 120.

[0121] In Figure 17B In a first example shown in FIG. 13A, the roster trend shows the number of members joining the group over time. In this example, multiple measurements are taken over a time period. When one or more measurements, such as the measurements at the second and fifth samples, exceed a threshold 1303, the server 120 can transmit an update command so that one or more client devices update one or more encryption keys for storage on the server 120.

[0122] In Figure 17B In a second example shown in FIG. 13B, the roster trend shows the rate of change of the membership roster, e.g., the derivative of the total number of members of the group over time. In this example, multiple measurements are taken over a time period. When a measurement exceeds a threshold 1303, e.g., at time A, or when a measurement falls below a threshold, e.g., at time C, the server 120 can transmit an update command so that one or more client devices update one or more encryption keys for storage on the server 120.

[0123] These examples are provided for illustrative purposes and should not be construed as limiting. It can be appreciated that other variants of these techniques are within the scope of the present disclosure. For example, although the threshold 1303 is shown as constant over time, it can be appreciated that the threshold 1303 can vary over time. For example, the threshold can be lower during peak hours of the system than during non-peak hours. In yet another variant, the server can also transmit an update command when the rate of change satisfies one or more conditions. For example, at time B in the second graph of FIG. 13B, the system can recognize a particular slope or a particular change in slope as a triggering event for an update command to be transmitted to one or more client devices. Figure 17B

[0124] Figure 17C ​A number of scenarios are illustrated that can cause the server 120 to transmit an update command to a client device. For example, in a first scenario, an update command can be transmitted to a client device in response to determining that a churn measurement exceeds a threshold, a data usage activity measurement does not satisfy a threshold, and a key age does not satisfy a threshold. In a second scenario, an update command can be transmitted to a client device in response to determining that a churn measurement exceeds a threshold, a data usage activity measurement exceeds a threshold, and a key age does not satisfy a threshold. In a third scenario, an update command can be transmitted to a client device in response to determining that a churn measurement exceeds a threshold, a data usage activity measurement exceeds a threshold, and a key age exceeds a threshold. In a fourth scenario, an update command can be transmitted to a client device in response to determining that a churn measurement does not exceed a threshold, a data usage activity measurement exceeds a threshold, and a key age does not satisfy a threshold. In a fifth scenario, an update command can be transmitted to a client device in response to determining that a churn measurement does not exceed a threshold, a data usage activity measurement exceeds a threshold, and a key age exceeds a threshold. In a sixth scenario, an update command can be transmitted to a client device in response to determining that a churn measurement does not exceed a threshold, a data usage activity measurement does not exceed a threshold, and a key age satisfies a threshold.

[0125] Turning now to Figure 18 Aspects of a routine 950 for controlling updates to encryption keys are shown and described below. The routine 950 begins at operation 951, where one or more program modules receive activity data indicative of a change in a number of members of a group. The activity data can be generated by a computing device such as the server 120. Alternatively, the activity data can be received by a remote computing device such as a group manager. The activity data can include measurements over a period of time, including but not limited to a change in the number of members, a rate at which members are leaving or joining the group, and the like. The activity data can also provide measurements regarding an amount of data shared by the group and / or data defining an age of an encryption key used by client devices and stored on the server 120.

[0126] Next, at operation 953, the one or more program modules analyze the activity data to determine whether the change in the number of members or other activity data satisfies one or more criteria. As described herein, one or more measurements of the following can be analyzed relative to one or more thresholds: a change in the number of members of the group, an amount of data shared by the group, and / or an age of a key utilized by the group. The one or more criteria can be determined to be satisfied when the activity data satisfies or exceeds the one or more thresholds.

[0127] If the change in the number of members or other activity data does not satisfy the one or more criteria, the routine 950 returns to operation 951, where the one or more program modules receive updated activity data. The one or more program modules can continue to monitor the updated activity data until the one or more measurements defined in the activity data satisfy the one or more criteria. When the one or more measurements defined in the activity data satisfy the one or more criteria, the routine 950 continues to operation 955, where the one or more modules verify group membership. In this operation, a verification request can be sent from the server 120 to the group manager 115. The group manager 115 can verify the current list of members of a particular group via the confirmation 122.

[0128] Next, at operation 957, the one or more program modules can transmit an update command to the client devices associated with each member of the group. The update command can cause each of the client devices to update one or more keys on each client device. As described herein, the update command can cause each client device to replace an existing key, such as a secret key, key pair, and / or vault key, with a new key. In some configurations, the server 120 can generate a vault key and transmit the vault key to each client in association with the update command. The update command can cause each client device to generate encrypted data, including an encrypted payload of secret data using the one or more updated keys, an encrypted secret key, and an encrypted vault key.

[0129] Next, at operation 959, the one or more program modules can receive the newly generated encrypted data from the client devices. In some configurations, the server 120 can receive the newly generated encrypted data, such as an encrypted payload of secret data using the one or more updated keys, an encrypted secret key, and an encrypted vault key.

[0130] Next, at operation 961, the one or more program modules can store the encrypted data in a vault associated with the user group. Prior to storing the received data and in some configurations, the server 120 can verify each member of the group prior to storing data for each group member. For example, if the group includes members of a channel, the server 120 can send a verification request to the group manager 115 with the identity of the user. If the group manager 115 responds with a confirmation 122 that the user is still a member of the channel, the server 120 can store the newly encrypted data in association with the user and the group.

[0131] Reference is now made to Figures 19A-19GTechnologies for managing access rights to secret data shared by a group of users are shown and described below. The technologies disclosed herein allow a storage service to coordinate with a group manager system, such as MS Teams or Slack, to verify membership of a group of users, e.g., a channel, chat session, meeting. The two systems, which can be operated by different entities, are able to automatically change access rights to stored data when a user leaves or joins a group. The technologies disclosed herein are able to provide a number of technical benefits that can alleviate or eliminate the need for manual tasks to remove, add or modify access permissions by leveraging data provided by the group manager.

[0132] Figure 19A Aspects of a system 100 that allow a server 120 to control access to data stored within a vault 109 based on user activity of a group manager 115 are illustrated. The group manager 115 is able to manage a communication session, such as a channel, between users of a group. For illustrative purposes, a channel includes a communication session that allows users to join a public or private group. Once a member, a user is able to share messages and other forms of data with other members. In this example, the group manager 115 is able to manage a channel that includes a user identity 113A associated with a single member 107A, Carol, and the user identity is associated with a group ID 112A. At the server 120, the group ID is associated with a vault 109, and the user identity 113A is also associated with the group ID 112 at the server. Figure 19A An example user interface 401 for a channel is illustrated in FIG. 1. In this example, the group (e.g., channel) includes a single member 107A, Carol, associated with a user identity 113A, and the user identity is associated with a group ID 112A. At the server 120, the group ID is associated with a vault 109, and the user identity 113A is also associated with the group ID 112 at the server.

[0133] In this example, the server 120 also includes a vault 109 for storing encrypted data for the current group members. The server 120 is able to control access to the vault 109 storing encrypted data, e.g., encrypted secret data 1 101A' generated by encrypting secret data 1 101A using a secret key 1102A, encrypted secret key 1 102A' generated by encrypting the secret key 1 102A using the vault key 104 associated with the user group 111, and encrypted vault key 1 104' generated by encrypting the vault key 104 using the public key 1 105A of the first private-public key pair 157A associated with the first user 107A of the user group 111. As described in greater detail below, access to the vault 109 for individual users is controlled based on the membership status of the user group 111.

[0134] Figure 19BAspects of a process for adding a person to a user group 111 are illustrated. In this example, in response to detecting that a user has been added, the group manager 115 sends membership data 155 indicating new members of the user group 111. The membership data 155 can also indicate people who have been removed from the group 111. Additionally, the membership data 155 can also indicate permission changes with respect to members of the user group 111. In Figure 19C In the example, the membership data 155 indicates that the first user (user 1) is a current member of the group 111 (group 1). Additionally, the membership data 165 indicates that the second user is a new member of the group. This example is provided for illustrative purposes and should not be construed as limiting. It can be appreciated that the membership data 155 indicating new users of a group can be provided by any computing device, including a client device. In such embodiments, when the membership data 155 is received from a client device, the server 120 can verify that the user sending the membership data 155 is still an active member of the group before allowing the server to take action on the membership data. Additionally, the server 120 can also determine whether the user sending the membership data 155 has the appropriate administrative permissions to add users to the vault. If the user associated with the membership data 155 does not have the appropriate permissions, the server can deny any action based on the membership data 155.

[0135] There are a variety of different methods that can be used to add users to a group. For example, an administrator of the group, such as the first user 107A, can allow new users to join the group. In such embodiments, the administrator can add the identity of the new user and also define one or more permissions. In other embodiments, users can join a public group without requiring a membership proof or approval of a join request.

[0136] There are a variety of techniques for adding users to a group. In one illustrative example, a first method involves a process initiated by a group owner. When an administrator adds a person to a group, such as a channel, the group owner can cause the system to collect the public key of the new user. The group owner can then cause the system to encrypt the vault key for each new user with each user's public key. Each new user can have access to a unique data structure that allows them to access the shared data of the group.

[0137] The second method involves a process initiated when a public join link is created, for example, allowing anyone to join the Seattle Running Club channel using the link. The system can grant access to the secret data by collecting a public key from any new user and using that public key to encrypt a vault key. The system can allow any member of the group, not just the group manager, to approve new users' entry.

[0138] In response to receiving membership data 155 instructing the addition of a second user 107B to group 111, server 120 is also able to configure the vault to allow the storage of encrypted data associated with the second user 107B by associating the second identity 113B with vault 109. Vault 109 can be configured to grant permission to the second user 107B to store encrypted data while the second user 107B is a current member of user group 111.

[0139] Additionally, once server 120 receives an instruction from a new member of a user's group, server 120 can issue one or more commands to cause the current member's client device to generate a vault key based on its encrypted vault key, and to generate an encrypted vault using the new member's public key. Figure 19D In this example of the phases shown, in response to receiving membership data 155 instructing a second user 107B to add to group 111, server 120 is able to send an update command 156 to client device 110A associated with the current member (e.g., first user 107A). Update command 156 causes client device 110A to generate an encrypted vault key 2 104B' by encrypting vault key 104 using the public key 2 105B of the second private-public key pair 157B associated with the second user 107B of user group 111. Server 120 is able to provide update command 156 to the public key 2 105B of the second private-public key pair 157B, or the public key 2 105B can be obtained by client device 110A from another resource (such as the second client 110B or a key service). If the vault key is not present on client computer 110A, server 120 is able to provide an encrypted vault key 1, which can be decrypted using the first user's private key. The encrypted vault key 1 can also be provided by the first client device 110A or by a service such as a remote key storage service.

[0140] In some configurations, a single client device or a selected group of client devices can be selected to generate the encrypted data for the new user. The selection of the device to generate the encrypted data can be based on a role or permission for each member. For example, if the user is a designated administrator for the group, the user and / or the user's corresponding device can be selected to provide the encrypted vault key for the new user. In other configurations, the client devices can communicate with each other on a peer-to-peer basis to determine which device will generate the encrypted vault key for the new user. The device can be selected based on the activity of the device or one or more capabilities of the individual device. For example, if it is determined that a particular computing device remains online for a period of time relative to other devices, the particular computing device can be selected to generate the encrypted vault key for the new user. In another example, if it is determined that a particular computing device has an architecture that is more conducive to generating the key, e.g., a desktop with a particular processor compared to a mobile device, the particular computing device can be selected from a pool of other candidate devices.

[0141] As shown in Figure 19E , the vault key for the new user can be transmitted to the client device 110B of the new user directly from the first client 110A (as shown with the dashed line) or by using another resource such as a key service. The vault key for the new user can also be transmitted to the server for storage in the vault 109 and / or from the server 120 to the client device 110B of the new user. In the present example, as shown in Figure 19F , the encrypted vault key 2 104B' can be stored at the server and / or transmitted to the client device 110B. The encrypted vault key 2 104B' is configured to generate the vault key 104 at the second client device 110B by using the private key 2 106B of the second private-public key pair 157B. The vault key 104 can then enable the second client device 110B to generate the encrypted secret key 2 102B' from the secret key 2 102B, which enables the second client device 110B to generate the encrypted secret data 2 101B' from the secret data 2 101B.

[0142] To store the encrypted data at the server 120, the client device 110B can send a write request 158 to the server to request that the server 120 store the encrypted secret data 2 101B', the encrypted secret key 2 102B', and the encrypted vault key 2 104B' in the vault 109 in association with the second user 107B. The write request 158 can include the encrypted data (as shown), or the write request 158 can be sent independent of the encrypted data.

[0143] As shown in Figure 19FAs shown in the middle, in response to the write request 158, the server can use the confirmation data 122 from the group manager to determine whether the second user 107B is a current member of the user group 111. The confirmation data 122 can be sent to the server in response to the verification request 121. If the confirmation data 122 confirms that the requesting user (the second user 107B) is a current member of the group 111, the server 120 can store the encrypted secret data 2 101B', the encrypted secret key 2 102B', and the encrypted vault key 2 104B' in the vault 109. However, if the confirmation data 122 shows that the requesting user (e.g., the second user 107B) is no longer a member of the group, the server 120 denies the write request by restricting the second user from storing the encrypted secret data 2 101B' and the encrypted secret key 2 102B' in the vault 109 if the second user 107B does not have write access or if the second user 107B is not a current member of the group 111.

[0144] This embodiment also allows users to share data, with reference to Figures 2D-2G The process for sharing data between users can occur after a new user has been added. Thus, in the current example, once the second user has been added to the group, the server 120 can receive an access request associated with the second user, where the access request requests the encrypted secret data 1 101A' stored in the vault in association with the first user. In response to the access request, the server 120 can transmit a verification request to the group manager 115. The verification request can include the identity of the second user and the group identifier associated with the group and the vault. The group manager 115 can check one or more records and send a roster or access confirmation to the server. The roster or access confirmation can indicate that the second user is a current member of the group or that the second user is not a current member of the group. In response to determining that the second user is a current member of the group, the server 120 can allow the encrypted secret data 1 101A', the encrypted secret key 1 102A', and the encrypted vault key 2 104B' to be transmitted to the requesting client device associated with the access request. The encrypted vault key 2 104B' can be configured to allow the vault key 104 to be generated at the requesting client device using the private key 2 106B of the second private-public key pair 157B. The vault key 104 can allow the secret key 1 to be generated, and the secret key 1 can allow the secret data 1 101A to be generated.

[0145] With reference to Figure 20Routines 975 for managing user permissions to vault systems based on group membership activity are shown and described below. Routines 975 begin at operation 976, where program modules 623 control access to vault 109 storing encrypted data, such as encrypted secret data 1 101A', encrypted secret key 1 102A', and encrypted vault key 1 104'. Encrypted secret data 1 101A' is generated by encrypting secret data 1 101A using secret key 1 102A, encrypted secret key 1 102A' is generated by encrypting secret key 1 102A using vault key 104 associated with user group 1 1 1, and encrypted vault key 1 104' is generated by encrypting vault key 104 using public key 1 105A of first private-public key pair 157A associated with first user 107A of user group 1 1 1. Access to vault 109 by individual users is controlled based on membership status of user group 1 1 1 and permissions that can be provided by a group manager.

[0146] A "group of users" as defined herein can include a group of computer users listed as members in a roster of a communication session or conference. A communication session can be managed by a system that can share text messages, data files, video feeds, real-time video, and audio or other forms of data. Each user can manually join a group, be invited by a member, and / or a system administrator can grant permission to participate in a communication session. Each member can be authenticated to participate in a communication session by using any suitable credentials. A user can leave a group by input commands issued by a member, by a group member, and / or by a system administrator.

[0147] At operation 977, program modules 623 receive membership data 155 indicating that a new member, such as second user 107B, is added to the group. In operation 977, server 120 can also configure the vault to allow storage of encrypted data associated with the new member, such as second user 107B, by associating second identity 1 13B with vault 109. Vault 109 can be configured to grant permission to second user 107B to store encrypted data while second user 107B is a current member of user group 1 1 1.

[0148] At operation 978, program modules 623 can issue one or more update commands causing client devices of current members to generate a vault key from its encrypted vault key. The commands can also cause an encrypted vault to be generated using a public key of the new member. As in Figure 19DIn the example described above with respect to FIG. 9, in response to receiving the membership data 155 indicating the addition of the second user 107B to the group 111, the server 120 can transmit an update command 156 to the client device 110A associated with the current member (e.g., the first user 107A). The update command 156 causes the client device 110A to generate an encrypted vault key 2 104B' by encrypting the vault key 104 using the public key 2 105B of the second private-public key pair 157B associated with the second user 107B of the user group 111. The server 120 can provide the update command 156 to the public key 2 105B of the second private-public key pair 157B, or the public key 2 105B can be obtained by the client device 110A from another resource, such as the second client 110B or a key service. If the vault key does not exist on the client computer 110A, the server 120 can provide the encrypted vault key 1, which can be decrypted by the first user's private key. The encrypted vault key 1 can also be provided by the first client device 110A or by a service such as a remote key storage service.

[0149] At operation 979, the program module 623 receives a write request 158 requesting that the server 120 store encrypted data. In one example, the request can include or reference the encrypted secret data 2 101B', the encrypted secret key 2 102B', and the encrypted vault key 2 104B', and direct that such data be stored in the vault 109 in association with the second user 107B. The write request 158 can include the encrypted data, or the write request 158 can be sent independent of the encrypted data.

[0150] At operation 980, the program module 623 receives a confirmation from the group manager 115 indicating the membership status of one or more users. In one illustrative example, the confirmation can include a group ID and a membership status for at least one user ID, e.g., that the first user 107A is a current member, or that the first user 107A is not a current member. The confirmation can also include one or more permissions for each user. For example, the confirmation can include a user ID and indicate whether that user ID is associated with read and / or write permissions. The confirmation can also describe roles or other attributes associated with individual user IDs. In one illustrative example, with reference to FIG. 9, the confirmation can include the group ID 111 and the user ID 107A, and indicate that the first user 107A is a current member of the group 111. Figure 1 At operation 980, the program module 623 receives a confirmation from the group manager 115 indicating the membership status of one or more users. In one illustrative example, the confirmation can include a group ID and a membership status for at least one user ID, e.g., that the first user 107A is a current member, or that the first user 107A is not a current member. The confirmation can also include one or more permissions for each user. For example, the confirmation can include a user ID and indicate whether that user ID is associated with read and / or write permissions. The confirmation can also describe roles or other attributes associated with individual user IDs. In one illustrative example, with reference to FIG. 9, the confirmation can include the group ID 111 and the user ID 107A, and indicate that the first user 107A is a current member of the group 111.

[0151] At operation 981, in response to receiving group confirmation 112 indicating that a user (such as second user 107B) is associated with a specific group, routine 975 proceeds to operation 982, wherein program module 623 is capable of taking multiple actions to allow the transmission and / or storage of encrypted data, such as encrypted secret data, encrypted secret keys, and encrypted vault keys. However, if group confirmation 112 indicates that a user (such as second user 107B) is not associated with a specific group, routine 975 proceeds to operation 983, wherein program module 623 is capable of taking many actions to restrict the transmission and / or storage of encrypted data, such as encrypted secret data, encrypted secret keys, and encrypted vault keys.

[0152] Figure 21 Additional details are shown for an exemplary computer architecture 600 for a computer, such as a server 120 or a client device 110. Figure 1 This allows the execution of the program components described above to provide enhanced security for encrypted data. Therefore, in Figure 21 The computer architecture 600 illustrated herein illustrates an architecture for server computers, mobile phones, PDAs, smartphones, desktop computers, netbooks, tablets, and / or laptops. Computer architecture 600 can be used to run any aspect of the software components presented herein.

[0153] exist Figure 21 The computer architecture 600 illustrated includes a central processing unit 602 (“CPU”), system memory 604 (including random access memory 606 (“RAM”) and read-only memory (“ROM”) 606), and a system bus 610 coupling the memory 604 to the CPU 602. A basic input / output system containing basic routines that facilitate the transfer of information between elements within the computer architecture 600 during startup is stored in the ROM 606. The computer architecture 600 also includes a mass storage device 612 for storing an operating system 607 and one or more application programs, including but not limited to program module 623. The illustrated mass storage device 612 may also store a file 622, which may include encryption keys, encrypted data, or other data required to operate the techniques described herein.

[0154] Mass storage device 612 is connected to CPU 602 via a mass storage device controller (not shown) connected to bus 610. Mass storage device 612 and its associated computer-readable media provide non-volatile storage for computer architecture 600. Although the description of computer-readable media as used herein refers to mass storage devices such as solid-state drives, hard disks, or CD-ROM drives, those skilled in the art will recognize that computer-readable media can be any available computer storage or communication medium accessible by computer architecture 600.

[0155] Communication media include computer-readable instructions, data structures, program modules, or other data in modulated data signals, such as carrier waves or other transmission mechanisms, including any transmission medium. The term "modulated data signal" means a signal that alters or sets one or more characteristics of itself in a manner that encodes information in the signal. By way of example, and not limitation, communication media include wired media such as wired networks or direct wired connections, and wireless media such as acoustic, RF, infrared, and other wireless media. Any combination of the above should also be included within the scope of computer-readable media.

[0156] By way of example and not limitation, computer storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. For example, computer media includes, but is not limited to: RAM, ROM, EPROM, EEPROM, flash memory or other solid-state storage technologies, CD-ROM, digital versatile disk (“DVD”), HD-DVD, BLU-RAY or other optical storage devices, cassette tape, magnetic tape, disk storage devices or other magnetic storage devices, or any other medium capable of being used to store desired information and accessible by computer architecture 600. For the purposes of the claims, the phrases “computer storage medium,” “computer-readable storage medium,” and variations thereof do not include wave, signal, and / or other transient and / or intangible communication media themselves.

[0157] Depending on the configuration, computer architecture 600 can operate in a networked environment using a logical connection to a remote computer via network 125 and / or another network (not shown). Computer architecture 600 can be connected to network 125 via a network interface unit 614 connected to bus 610. It should be appreciated that network interface unit 614 can also be used to connect to other types of networks and remote computer systems. Computer architecture 600 may also include an input / output controller 616 for receiving and processing input from many other devices, including a keyboard, mouse, or electronic stylus (in... Figure 21(not shown). Similarly, input / output controller 616 can provide output to a display, a printer, or other type of output device (not shown). Figure 21 (not shown).

[0158] It will be appreciated that the software components described herein can be loaded into CPU 602 and run to convert the CPU 602 and overall computing architecture 600 from a general purpose computing system into a special purpose computing system customized to facilitate the functionality presented herein. CPU 602 can be comprised of any number of transistors or other discrete circuit elements, which can individually or collectively be represented by a number of states. More specifically, the CPU 602 can operate as a finite-state machine, in response to executable instructions contained within the software modules disclosed herein. These computer-executable instructions can transform the CPU 602 by specifying how the transistors or other discrete circuit elements constituting the CPU 602 are to be configured to perform a state change at various points in time.

[0159] Encoding the software modules presented herein can also transform the physical structure of computer-readable media presented herein. The specific transformation of physical structure can depend on various factors, in different implementations of this description. Examples of such factors can include, but are not limited to, the technology used to implement the computer-readable media, whether the computer-readable media is characterized as primary or secondary storage, or the like. For example, if the computer-readable media is implemented using semiconductor-based memory, the software disclosed herein can be encoded on the computer-readable media by transforming the physical state of the semiconductor memory. For example, the software can transform the state of transistors, capacitors or other discrete circuit elements constituting the semiconductor memory. The software can also transform the physical state of such components in order to store data thereupon.

[0160] As another example, the computer-readable media disclosed herein can be implemented using magnetic or optical technology. In such implementations, the software presented herein can transform the physical state of magnetic or optical media, when it is encoded therein. These transformations can include altering the magnetic characteristics of particular locations within given magnetic media. These transformations also can include altering the physical features or characteristics of particular locations within given optical media, to change the optical characteristics of those locations. Other transformations of physical media are possible and can be utilized to store data disclosed herein, without departing from the scope and spirit of the present description. The foregoing examples are merely illustrative of the possible transformations that can occur with respect to physical media.

[0161] In light of the above, it should be recognized that many types of physical transformations occur within computer architecture 600 to store and run the software components presented herein. It should also be recognized that computer architecture 600 may include other types of computing devices, including handheld computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those skilled in the art. It is also contemplated that computer architecture 600 may not be included in… Figure 21 All components shown in the components can be included in Figure 21 Other components not explicitly shown in the document, or those that can be utilized with the document. Figure 21 The architecture shown is completely different from the one shown.

[0162] Figure 22 An illustrative distributed computing environment 700, capable of running the software components described herein to provide enhanced security for encrypted data, and other aspects, is depicted. Therefore, in Figure 22 The distributed computing environment 700 illustrated herein can be used to run any aspect of the software components presented herein. For example, the distributed computing environment 700 can be used to run program module 623 and / or other aspects of the other software components described herein.

[0163] Depending on the implementation, the distributed computing environment 700 includes a computing environment 702 that operates on, communicates with, or is part of the network 125. The network 125 may be or may include the network 125, as referenced above. Figure 21 As described. Network 125 can also include various access networks. One or more client devices 706A-706N (hereinafter uniformly and / or generally referred to as "client 706") can be connected via network 125 and / or other connections (in... Figure 22 (Not shown in the figures) communicates with computing environment 702. In one illustrated configuration, client 706 includes computing device 706A, such as a laptop computer, desktop computer, or other computing device; tablet or rack-mount computing device (“tablet computing device”) 706B; mobile computing device 706C, such as a mobile phone, smartphone, or other mobile computing device; server computer 706D; and / or other devices 706N. It should be understood that any number of clients 706 can communicate with computing environment 702. References herein Figure 6 and Figure 8 Two exemplary computing architectures for client 706 are illustrated and described herein. It should be understood that the illustrated client 706 and the computing architectures illustrated and described herein are illustrative and should not be construed as limiting in any way.

[0164] In the illustrated configuration, the computing environment 702 includes an application server 708, a data store 710, and one or more network interfaces 712. According to various implementations, the functionality of the application server 708 can be provided by one or more server computers that operate as part of the network 125 or that communicate with the network 125. The application server 708 can host various services, virtual machines, portals, and / or other resources. In the illustrated configuration, the application server 708 can host one or more virtual machines for running applications or other functionality. According to various implementations, the virtual machines can run one or more applications and / or software modules that are used to provide enhanced security for encrypted data. It should be appreciated that this configuration is illustrative, and should not be construed as limiting in any way. The application server 708 also hosts or provides access to one or more portals, link pages, websites, and / or other information ("web portals") 716. The web portals 716 can be used to communicate with one or more client computers.

[0165] As shown in Figure 22 , the application server 708 can also host other services, applications, portals, and / or other resources ("other resources") 724. The other resources 724 can deploy a service-oriented architecture or any other client-server management software. It can thus be appreciated that the computing environment 702 can provide integration of the concepts and technologies disclosed herein with various mailbox, messaging, social networking, and / or other services or resources.

[0166] As mentioned above, the computing environment 702 can include a data store 710. According to various implementations, the functionality of the data store 710 is provided by one or more databases that operate on or communicate with the network 125. The functionality of the data store 710 can also be provided by one or more server computers that are configured to host data for the computing environment 702. The data store 710 can include, host, or provide one or more real or virtual containers 726A-726N (hereinafter collectively and / or generically referred to as "containers 726"). The containers 726, which can be used to form vaults, are configured to host data and / or other data used or created by the application server 708. Although not illustrated in Figure 22 , the containers 726 can also host or store data structures and / or algorithms for modules such as the program modules 623 to run. Aspects of the containers 726 can be a database program, a file system, and / or any program that stores data with security access features. Aspects of the containers 726 can also be implemented using a product or service such as ACTIVE DIRECTORY, DKM, ONEDRIVE, DROPBOX, or GOOGLE DRIVE.

[0167] The computing environment 702 can be in communication with or have access to a network interface 712. The network interface 712 can include various types of network hardware and software for supporting communications between two or more computing devices, including but not limited to the clients 706 and the application servers 708. It should be appreciated that the network interface 712 can also be used to connect to other types of networks and / or computer systems.

[0168] It should be appreciated that the distributed computing environment 700 described herein can provide any number of virtual computing resources to any aspect of the software elements described herein and / or can be configured to run other distributed computing functions of any aspect of the software elements disclosed herein. According to various implementations of the concepts and technologies disclosed herein, the distributed computing environment 700 provides the software functions described herein as a service to the clients 706. It should be appreciated that the clients 706 can include real or virtual machines, including but not limited to: server computers, network servers, personal computers, mobile computing devices, smart phones, and / or other devices. As such, various configurations of the concepts and technologies disclosed herein enable any device configured to access the distributed computing environment 700 to utilize the functions described herein to provide enhanced security for encrypted data, among other aspects. In one particular example, as outlined above, the technologies described herein can be implemented, at least in part, by an application server 708 in conjunction with a web browser application operating on a client 706. Figure 22

[0169] Turning now to Figure 23 an illustrative computing device architecture 800 for a computing device that can run the various software components described herein for providing enhanced security for encrypted data. The computing device architecture 800 is suitable for use in computing devices that facilitate mobile computing, in part due to form factor, wireless connectivity, and / or battery power operation. In some configurations, the computing device includes, but is not limited to: mobile telephones, tablet devices, slate devices, portable video game devices, and the like. The computing device architecture 800 is suitable for use in any of the clients 706 shown in FIG. 7. Moreover, aspects of the computing device architecture 800 can be suitable for use in conventional desktop computers, portable computers (e.g., laptop computers, notebook computers, ultraportable computers, and netbooks), server computers, and other computer systems, such as those described herein with reference to FIG. 6. Figure 22 Figure 23 For example, the single-touch and multi-touch aspects disclosed below can be applied to a desktop computer that utilizes a touchscreen or some other touch-enabled device, such as a trackpad that supports modules or a touch-enabled mouse.

[0170] In​​Figure 23 The computing device architecture 800 illustrated in FIG. 8 includes a processor 802, a memory component 804, a network connectivity component 806, a sensor component 808, an input / output component 810, and a power supply component 812. In the illustrated configuration, the processor 802 is in communication with the memory component 804, the network connectivity component 806, the sensor component 808, the input / output (“I / O”) component 810, and the power supply component 812. Although illustrated as a single component in FIG. 8, the processor 802 can comprise multiple processors, such as a Figure 23 Although connections between individual components are not shown in FIG. 8, the components can interact to carry out device functions. In some configurations, the components are arranged so as to permit them to interact via one or more buses (not shown).

[0171] The processor 802 includes a central processing unit (“CPU”) configured to process data, run computer program instructions of one or more application programs, and communicate with other components of the computing device architecture 800 in order to perform various functions as described herein. The processor 802 can be used to run aspects of the software components presented herein, and in particular those aspects that make use of touch-enabled input, at least in part.

[0172] In some configurations, the processor 802 includes a graphics processing unit (“GPU”) configured to accelerate operations performed by the CPU, including, but not limited to, operations performed in conjunction with running general-purpose scientific and / or engineering computing applications and graphics-intensive computing applications, such as high resolution video (e.g., 720P, 1080P, and higher resolution), video games, three-dimensional (“3D”) modeling applications, and the like. In some configurations, the processor 802 is configured to communicate with a discrete GPU (not shown). In either case, the CPU and GPU can be configured according to a co-processing CPU / GPU computational model in which sequential parts of an application run on the CPU and compute-intensive portions are accelerated by the GPU.

[0173] In some configurations, the processor 802, along with one or more of the other components described below, is a system on a chip (“SoC”) or is contained within a SoC. For example, a SoC can include the processor 802, a GPU, one or more network connectivity components 806, and one or more sensor components 808. In some configurations, the processor 802 is manufactured using a package-on-package (“PoP”) integrated circuit packaging technique. The processor 802 can be a single-core or multi-core processor.

[0174] The processor 802 can be created according to the ARM architecture, which is available for license from ARM HOLDINGS of Cambridge, United Kingdom. Alternatively, the processor 802 can be created according to the x86 architecture, such as is available from INTEL CORPORATION of Mountain View, California and others. In some configurations, the processor 802 is a SNAPDRAGON SoC available from QUALCOMM of San Diego, California, a TEGRA SoC available from NVIDIA of Santa Clara, California, a HUMMINGBIRD SoC available from SAMSUNG of Seoul, South Korea, an open multimedia applications platform (“OMAP”) SoC available from TEXAS INSTRUMENTS of Dallas, Taxas, a custom version of any of the aforementioned SoCs, or a proprietary SoC.

[0175] The memory components 804 include random access memory (“RAM”) 814, read-only memory (“ROM”) 816, integrated storage memory (“integrated storage”) 818, and removable storage memory (“removable storage”) 820. In some configurations, the RAM 814 or a portion thereof, the ROM 816 or a portion thereof, and / or some combination of the RAM 814 and the ROM 816 is integrated in the processor 802. In some configurations, the ROM 816 is configured to store a firmware, an operating system or a portion thereof (e.g., an operating system kernel), and / or a bootloader to load the operating system kernel from the integrated storage 818 and / or the removable storage 820.

[0176] The integrated storage 818 can include solid-state memory, a hard disk, or a combination of solid-state memory and a hard disk. The integrated storage 818 can be soldered or otherwise connected to a logic board on which the processor 802 and other components described herein can also be connected. As such, the integrated storage 818 is integrated in the computing device. The integrated storage 818 is configured to store an operating system or portions thereof, application programs, data, and other software components described herein.

[0177] The removable storage device 820 can include solid state memory, a hard disk, or a combination of solid state memory and a hard disk. In some configurations, the removable storage device 820 is provided in place of the integrated storage device 818. In other configurations, the removable storage device 820 is provided as an additional optional storage device. In some configurations, the removable storage device 820 is logically combined with the integrated storage device 818 such that the total available storage is available as a total combined storage capacity. In some configurations, the total combined capacity of the integrated storage device 818 and the removable storage device 820 is shown to the user rather than the individual storage capacities of the integrated storage device 818 and the removable storage device 820.

[0178] The removable storage device 820 is configured to be inserted into a removable storage memory slot (not shown) or other mechanism by which the removable storage device 820 is inserted and secured to facilitate a connection by which the removable storage device 820 can communicate with other components of the computing device, such as the processor 802. The removable storage device 820 can be embodied in various storage card formats including, but not limited to: PC card, CompactFlash card, Memory Stick, Secure Digital ("SD"), miniSD, microSD, Universal Integrated Circuit Card ("UICC") (e.g., a Subscriber Identity Module ("SIM") or Universal SIM ("USIM")), a proprietary format, or the like.

[0179] It is to be appreciated that one or more of the memory components 804 can store an operating system. Depending on the configuration, the operating system includes, but is not limited to: SYMBIAN OS from SYMBIAN LIMITED, WINDOWS MOBILE OS from Microsoft Corporation of Redmond, Washington, WINDOWS PHONE OS from Microsoft Corporation, WINDOWS from Microsoft Corporation, PALM WEBOS from Hewlett-Packard Company of Palo Alto, California, BLACKBERRY OS from Research In Motion Limited of Waterloo, Ontario, Canada, IOS from Apple Inc. of Cupertino, California, and ANDROID OS from Google Inc. of Mountain View, California. Other operating systems are contemplated.

[0180] The network connectivity components 806 include wireless wide area network components ("WW AN components") 822, wireless local area network components ("WLAN components") 824, and wireless personal area network components ("WPAN components") 826. The network connectivity components 806 facilitate communications to and from a network 125 or another network, which can be a WW AN, a WLAN, or a WPAN. Although only the network 125 is illustrated, the network connectivity components 806 can facilitate simultaneous communications with multiple networks, including Figure 20 the network 125. For example, the network connectivity components 806 can facilitate simultaneous communications with multiple networks via one or more WW ANs, WLANs, or WPANs.

[0181] The network 125 can be or include a WW AN, such as a mobile telecommunications network utilizing one or more mobile telecommunications technologies to provide voice and / or data services to computing devices via the WW AN components 822 with the computing device architecture 800. Mobile telecommunications technologies can include, but are not limited to, Global System for Mobile communications ("GSM"), Code Division Multiple Access ("CDMA") ONE, CDMA2000, Universal Mobile

[0182] In some configurations, the WWAN component 822 is configured to provide dual multi-mode connectivity to the network 125. For example, the WWAN component 822 can be configured to provide connectivity to the network 125, where the network 125 provides service via GSM and UMTS technologies, or via some other combination of technologies. Alternatively, multiple WWAN components 822 can be used to perform such functionality, and / or provide additional functionality to support other non-compatible technologies (i.e., that cannot be supported by a single WWAN component). The WWAN component 822 can facilitate similar connectivity with multiple networks (e.g., a UMTS network and a LTE network).

[0183] The network 125 can be a WLAN that operates according to one or more Institute of Electrical and Electronics Engineers (“IEEE”) 802.11 standards, such as IEEE 802.11a, 802.11b, 802. l lg, 802.11h, and / or future 802.11 standard (collectively referred to herein as WI-FI). Draft 802.11 standards are also contemplated. In some configurations, the WLAN is implemented with one or more wireless WI-FI access points. In some configurations, the one or more wireless WI-FI access points are another computing device that connects to a WWAN that functions as a WI-FI hotspot. The WLAN component 824 is configured to connect to the network 125 via a WI-FI access point. Such a connection can be secured via various encrypted technologies, including but not limited to: WI-FI Protected Access (“WPA”), WPA2, Wired Equivalent Privacy (“WEP”), etc.

[0184] The network 125 can be a WPAN that operates according to Infrared Data Association (“IrDA”), Bluetooth, Wireless Universal Serial Bus (“USB”), Z-Wave, ZIGBEE, or some other short range wireless technology. In some configurations, the WPAN component 826 is configured to facilitate communication with other devices, such as peripheral devices, computers, or other computing devices, via a WPAN.

[0185] The sensor component 808 includes a magnetometer 828, an ambient light sensor 830, a proximity sensor 832, an accelerometer 834, a gyroscope 836, and a global positioning system sensor (“GPS sensor”) 838. It is contemplated that other sensors, such as but not limited to a temperature sensor or a shock detection sensor, can also be incorporated in the computing device architecture 800.

[0186] Magnetometer 828 is configured to measure the strength and direction of a magnetic field. In some configurations, magnetometer 828 provides measurements to a compass application stored within one of memory components 804 to provide a user with accurate directions in a frame of reference, including cardinal directions, north, south, east, and west. Similar measurements can be provided to a navigation application that includes a compass component. Other uses of measurements obtained by magnetometer 828 are contemplated.

[0187] Ambient light sensor 830 is configured to measure ambient light. In some configurations, ambient light sensor 830 provides measurements to an application stored within one of memory components 804 to automatically adjust the brightness of a display (as described below) to compensate for low and high light environments. Other uses of measurements obtained by ambient light sensor 830 are contemplated.

[0188] Proximity sensor 832 is configured to detect the presence of an object or thing in proximity to a computing device without direct contact. In some configurations, proximity sensor 832 detects the presence of a user's body (e.g., the user's face) and provides this information to an application stored within one of memory components 804 that utilizes the proximity information to enable or disable certain functions of the computing device. For example, a telephone application can automatically disable a touch screen (as described below) in response to receiving proximity information so that the user's face does not inadvertently end a call during a conversation or enable / disable other functions within the telephone application. Other uses of proximity detected by proximity sensor 828 are contemplated.

[0189] Accelerometer 834 is configured to measure proper acceleration. In some configurations, output from accelerometer 834 is used by an application as an input mechanism to control some function of the application. For example, an application can be a video game in which a character, a portion of a character, or an object is moved or otherwise manipulated in response to input received via accelerometer 834. In some configurations, output from accelerometer 834 is provided to an application for switching between landscape and portrait modes, calculating coordinate acceleration, or detecting a fall. Other uses of accelerometer 834 are contemplated.

[0190] Gyroscope 836 is configured to measure and maintain orientation. In some configurations, output from gyroscope 836 is used by an application as an input mechanism to control some function of the application. For example, gyroscope 836 can be used to accurately identify motion within a 3D environment of a video game application or some other application. In some configurations, an application utilizes output from gyroscope 836 and accelerometer 834 to enhance control over some function of the application. Other uses of gyroscope 836 are contemplated.

[0191] The GPS sensor 838 is configured to receive signals from GPS satellites for calculating a location. The location calculated by the GPS sensor 838 can be used by any application that desires or benefits from location information. For example, the location calculated by the GPS sensor 838 can be used with a navigation application to provide directions from the location to a destination or directions from a destination to the location. Further, the GPS sensor 838 can be used to provide location information to an external location-based service, such as E911 service. The GPS sensor 838 can obtain location information generated via WI-FI, WIMAX, and / or cellular triangulation techniques that utilize one or more of the network connectivity components 806 to assist the GPS sensor 838 in obtaining positioning. The GPS sensor 838 can also be used in an Assisted GPS (“A-GPS”) system.

[0192] The I / O components 810 include a display 840, a touchscreen 842, a data I / O interface component (“data I / O”) 844, an audio I / O interface component (“audio I / O”) 846, a video I / O interface component (“video I / O”) 848, and a camera 850. In some configurations, the display 840 and the touchscreen 842 are combined. In some configurations, two or more of the data I / O component 844, the audio I / O component 846, and the video I / O component 848 are combined. The I / O components 810 can include discrete processors configured to support the various interfaces described below, or can include processing functionality built into the processor 802.

[0193] The display 840 is an output device configured to present information in visual form. Specifically, the display 840 can present graphical user interface (“GUI”) elements, text, images, video, notifications, virtual buttons, virtual keyboards, messaging data, internet content, device status, time, date, calendar data, preferences, map information, location information, and any other information capable of being presented in visual form. In some configurations, the display 840 is a liquid crystal display (“LCD”) utilizing any active or passive matrix technology and any backlighting technology (if used). In some configurations, the display 840 is an organic light emitting diode (“OLED”) display. Other display types are contemplated.

[0194] The touch screen 842 (also referred to herein as a "touch-enabled screen") is an input device configured to detect the presence and location of a touch. The touch screen 842 can be a resistive touch screen, a capacitive touch screen, a surface acoustic wave touch screen, an infrared touch screen, an optical imaging touch screen, a dispersive signal touch screen, a sound pulse recognition touch screen, or can utilize any other touch screen technology. In some configurations, the touch screen 842 is incorporated as a transparent layer on top of the display 840 to enable a user to use one or more touches to interact with objects or other information presented on the display 840. In other configurations, the touch screen 842 is a touchpad incorporated on a surface of the computing device that does not include the display 840. For example, the computing device can have a touch screen incorporated on top of the display 840 and a touchpad on a surface opposite the display 840.

[0195] In some configurations, the touch screen 842 is a single-point touch touch screen. In other configurations, the touch screen 842 is a multi-point touch touch screen. In some configurations, the touch screen 842 is configured to detect discrete touches, single-point touch gestures, and / or multi-point touch gestures. For convenience, these are collectively referred to herein as gestures. Several gestures will now be described. It should be understood that these gestures are illustrative and are not intended to limit the scope of the accompanying claims. Moreover, the described gestures, additional gestures, and / or alternative gestures can be implemented in software for use with the touch screen 842. In this manner, developers can create gestures that are specific to particular applications.

[0196] In some configurations, the touch screen 842 supports a tap gesture, where a user taps the touch screen 842 once on an item presented on the display 840. The tap gesture can be used for various reasons, including but not limited to opening or launching whatever the user taps. In some configurations, the touch screen 842 supports a double tap gesture, where a user taps the touch screen 842 twice on an item presented on the display 840. The double tap gesture can be used for various reasons, including but not limited to zooming in or out in stages. In some configurations, the touch screen 842 supports a tap and hold gesture, where a user taps the touch screen 842 and holds the contact for at least a predetermined time. The tap and hold gesture can be used for various reasons, including but not limited to opening a context-specific menu.

[0197] In some configurations, touch screen 842 supports a pan gesture, where a user places a finger on the touch screen 842 and keeps in contact with the touch screen 842 while moving the finger across the touch screen 842. Panning can be used for a variety of reasons, including but not limited to moving through a screen, image, or menu at a controlled rate. Multiple finger panning gestures are also contemplated. In some configurations, touch screen 842 supports a flick gesture, where a user swipes a finger in the direction the user wants the screen to move. Flick gestures can be used for a variety of reasons, including but not limited to horizontally or vertically scrolling through a menu or a page. In some configurations, touch screen 842 supports pinch and stretch gestures, where a user pinches the touch screen 842 with two fingers (e.g., thumb and forefinger), or moves the two fingers apart. Pinch and stretch gestures can be used for a variety of reasons, including but not limited to, zooming in or out on a website, map, or picture.

[0198] Although the above gestures have been described with reference to using one or more fingers to perform the gestures, other appendages such as toes or objects such as styluses can be used to interact with the touch screen 842. As such, the above gestures should be understood to be illustrative, and should not be construed as being limiting in any way.

[0199] Data I / O interface component 844 is configured to facilitate input and output of data to and from the computing device. In some configurations, data I / O interface component 844 includes a connector configured to provide a wired connection between the computing device and a computer system, for example, for synchronization operation purposes. The connector can be a proprietary connector or a standardized connector, such as a USB, micro-USB, mini-USB, and the like. In some configurations, the connector is a docking connector, which is used to dock the computing device with another device, such as a docking station, an audio device (e.g., a digital music player), or a video device.

[0200] Audio I / O interface component 846 is configured to provide audio input and / or output capabilities to the computing device. In some configurations, audio I / O interface component 846 includes a microphone configured to gather audio signals. In some configurations, audio I / O interface component 846 includes a headphone jack configured to provide a connection for headphones or other external speakers. In some configurations, audio I / O interface component 846 includes a speaker for outputting audio signals. In some configurations, audio I / O interface component 846 includes an optical audio cable output.

[0201] The video I / O interface component 848 is configured to provide video input and / or output capabilities to the computing device. In some configurations, the video I / O interface component 848 includes a video connector configured to receive video as input from another device (e.g., a video media player such as a DVD or Blu-ray player) or send video as output to another device (e.g., a monitor, a television, or some other external display). In some configurations, the video I / O interface component 848 includes a High-Definition Multimedia Interface (“HDMI”), mini-HDMI, micro-HDMI, DisplayPort, or a proprietary connector for inputting / outputting video content. In some configurations, the video I / O interface component 848 or portions thereof are combined with the audio I / O interface component 846 or portions thereof.

[0202] The camera 850 can be configured to capture still images and / or video. The camera 850 can utilize a charge-coupled device (“CCD”) or a complementary metal-oxide semiconductor (“CMOS”) image sensor to capture images. In some configurations, the camera 850 includes a flash to aid in taking pictures in low-light environments. Settings for the camera 850 can be implemented as hardware or software buttons.

[0203] Although not illustrated, one or more hardware buttons can also be included in the computing device architecture 800. The hardware buttons can be used to control some operational aspect of the computing device. The hardware buttons can be dedicated buttons or multi-purpose buttons. The hardware buttons can be mechanical or sensor-based.

[0204] The illustrated power component 812 includes one or more batteries 852 that can be connected to a battery gauge 854. The batteries 852 can be rechargeable or disposable. Rechargeable battery types include, but are not limited to: lithium polymer, lithium ion, nickel-cadmium, and nickel-metal hydride. Each of the batteries 852 can be made of one or more battery cells.

[0205] The battery gauge 854 can be configured to measure battery parameters such as current, voltage, and temperature. In some configurations, the battery gauge 854 is configured to measure the rate of discharge, temperature, age, and other factors of the battery to predict remaining life within a certain percentage of error. In some configurations, the battery gauge 854 provides measurements to an application that is configured to utilize the measurements to present useful power management data to a user. The power management data can include one or more of battery used percentage, battery remaining percentage, battery condition, time remaining, remaining capacity (e.g., in watt hours), current draw, and voltage.

[0206] The power component 812 can also include a power connector, which can be combined with one or more of the previously described I / O components 810. The power component 812 can interface with an external power system or charging equipment via a power I / O.

[0207] The disclosure presented herein can be considered in view of the following clauses.

[0208] Clause A: A method of managing secret data using a vault key for a group 111 of users, the method performed by a data processing system 120, comprising: receiving encrypted secret data 101A' generated on a remote computing device from secret data 101A by using a secret key 102A; receiving an encrypted secret key 102A' generated from the secret key 102A by using a vault key 104 associated with the group of users; receiving an encrypted vault key 104' generated from the vault key 104 by using a public key 105A of a private-public key pair associated with a first user 107A of the group 111 of users; transmitting a verification request 121 to a group management system 115, the verification request 121 including an identity 113 of the first user 107A and a group identifier 112 associated with the group 111; receiving a confirmation 122 from the group management system 115, the confirmation 122 indicating a membership status of the first user 107A for the group 111 associated with the group identifier 112; and responsive to receiving the confirmation 112 indicating that the first user 107A is a current member of the group 111, storing the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104' in a vault 109 configured to allow write access to members of the group 111.

[0209] Clause B: The method of clause A, further comprising: responsive to receiving the confirmation indicating that the first user is not a current member of the group, restricting storing the encrypted secret data, the encrypted secret key, and the encrypted vault key in the vault.

[0210] Clause C: The method of clauses A and B, further comprising: receiving an access request from a computing device associated with the first user, the access request requesting at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key; responsive to the access request, transmitting a verification request to the group management system, the verification request including the identity of the first user and the group identifier associated with the group and the vault; receiving an access confirmation from the group management system, the access confirmation indicating the membership status of the first user for the group associated with the group identifier; and responsive to receiving the access confirmation indicating that the first user is a current member of the group, transmitting the encrypted secret data, the encrypted secret key, and the encrypted vault key from the vault to a client computer associated with the first user, wherein encrypted vault key is configured to be decrypted using a private key of the private-public key pair to generate the vault key.

[0211] Clause D: The method of clauses A-C, further comprising: receiving an access request from a computing device associated with the first user, the access request requesting at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key; responsive to the access request, transmitting a verification request to the group management system, the verification request including the identity of the first user and the group identifier associated with the group and the vault; and receiving an access confirmation from the group management system, the access confirmation indicating the membership status of the first user for the group associated with the group identifier; and responsive to receiving the access confirmation indicating that the first user is not a current member of the group, restricting access to the encrypted secret data, the encrypted secret key, and the encrypted vault key stored in the vault.

[0212] Clause E: The method of clauses A-D, further comprising: receiving updated encrypted secret data from a computing device associated with the first user, the updated encrypted data generated on the computing device using the secret key; transmitting a subsequent verification request to the group management system, the subsequent verification request including the identity of the first user and the group identifier associated with the group and the vault; receiving a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the membership status of the first user for the group associated with the group identifier; and if the subsequent access confirmation indicates that the first user is a current member of the group, storing the updated encrypted secret data in the vault, wherein if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data is restricted from being stored in the vault.

[0213] Clause F: The method of clauses A-E, further comprising: receiving updated encrypted secret data from a computing device associated with the first user, the updated encrypted data generated on the computing device using an updated secret key; receiving an encrypted updated secret key, the encrypted updated secret key encrypted from the updated secret key using the vault key; transmitting a subsequent verification request to the group management system, the subsequent verification request including the identity of the first user and the group identifier associated with the group and the vault; receiving a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the membership status of the first user for the group associated with the group identifier; and if the subsequent access confirmation indicates that the first user is a current member of the group, storing the updated encrypted secret data and the encrypted updated secret key in the vault, wherein if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data and the encrypted updated secret key are restricted from being stored in the vault.

[0214] Clause G: The method of clauses A-F, further comprising: receiving an updated encrypted vault key from the computing device associated with the first user, the updated encrypted vault key generated from the vault key using an updated public key from an updated private-public key pair associated with the user, wherein the updated encrypted vault key is configured to be decrypted by using an updated private key from the updated private-public key pair.

[0215] Clause H: The method of clauses A-G, further comprising: receiving an updated encrypted vault key associated with the first user, the updated encrypted vault key generated from the vault key using an updated public key from an updated private-public key pair associated with the user; and storing the updated encrypted vault key in the vault if the subsequent access confirmation indicates that the first user is a current member of the group, wherein the updated encrypted vault key is restricted from being stored in the vault if the subsequent access confirmation indicates that the first user is not a current member of the group.

[0216] Clause I: The method of clauses A-H, wherein the vault stores thereon a second encrypted vault key associated with a second user, the second encrypted vault key configured to be decrypted by use of a private key associated with the second user to generate the vault key, the method further comprising: receiving an access request from a computing device associated with a second user, the access request requesting the encrypted secret data stored in association with the first user; in response to the access request, transmitting a verification request to the group management system, the verification request including the identity of the second user and the group identifier associated with the group and the vault; receiving an access confirmation from the group management system, the access confirmation indicating a membership status of the second user with respect to the group; and in response to receiving the access confirmation indicating that the second user is a current member of the group, transmitting the encrypted secret data, the encrypted secret key, and the second encrypted vault key from the vault to a client computer associated with the second user.

[0217] Clause J: The method of clauses A-I, further comprising: in response to receiving the access confirmation indicating that the first user is not a current member of the group, restricting a computing device associated with the second user from accessing the encrypted secret data, the encrypted secret key, and the encrypted vault key stored in the vault.

[0218] Clause K: A computer 110A comprising: a processor 602; and a computer-readable storage medium 604 in communication with the processor 602, the computer-readable storage medium 604 having stored thereon computer executable instructions, which when executed by the processor 602, cause the computer 110A' to: generate encrypted secret data 101A from secret data 101A using a secret key 102A; generate encrypted secret key 102A' from the secret key 102A using a vault key 104 associated with a group 111 of users; generate encrypted vault key 104' from the vault key 104 using a public key 105A of a private-public key pair associated with a first user 107A of the group 111 of users; and transmit the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104' to a server 120 for storage in a vault 109, the transmitting causing the server 120 to determine whether the first user 107A is a current member of the group 111 using an attestation 112 from a group manager 115 defining a membership status of the first user, the server 120 allowing the first user 107A to store data to the vault 109 if the attestation 112 indicates that the first user 107A is a current member of the group 111.

[0219] Clause L: The computer of clause K, wherein the instructions further cause the computer to perform a process for sharing a single key with multiple devices for a single user, wherein the method comprises: encrypting a private key of the private-public key pair using a symmetric key to generate an encrypted private key; transmitting the symmetric key in a secure service running on a remote device, wherein the secure service provides access to the symmetric key by using one or more credentials associated with the first user; and transmitting the encrypted private key to a secure storage associated with an operating system of one or more computing devices, wherein the encrypted private key is protected using the one or more credentials associated with the first user.

[0220] Clause M: The computer of clauses K and L, wherein the instructions further cause the computer to: send an access request to the server to request at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key, wherein the access request causes the server to determine whether the first user is a current member of the group using a subsequent confirmation from a group manager defining the membership status of the first user, and if the subsequent confirmation indicates that the first user is a current member of the group, the server communicates the at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key to the computer; and receive the at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key at the computer.

[0221] Clause N: The computer of clauses K-M, wherein the instructions further cause the computer to: send an access request to the server to request at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key, wherein the access request causes the server to determine whether the first user is a current member of the group using a subsequent confirmation from a group manager defining the membership status of the first user, and if the subsequent confirmation indicates that the first user is not a current member of the group, the server denies communicating the at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key to the computer; and receive a notification at the computer indicating a status of the access request.

[0222] Clause O: The computer of clauses K-N, wherein the instructions further cause the computer to: encrypt updated secret data using the secret key to generate encrypted secret data; communicate a subsequent verification request to the group management system, the subsequent verification request including the identity of the first user and the group identifier associated with the group and the vault; receive a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the membership status of the first user for the group associated with the group identifier; and if the subsequent access confirmation indicates that the first user is a current member of the group, store the updated encrypted secret data in the vault, wherein if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data is to be restricted from being stored in the vault.

[0223] Clause P: A computer system 120 comprising: means for receiving encrypted secret data 101A' generated on a remote computing device from secret data 101A by use of a secret key 102A; means for receiving an encrypted secret key 102A' generated from the secret key 102A by use of a vault key 104 associated with the group of users; means for receiving an encrypted vault key 104' generated from the vault key 104 using a public key 105A of a private-public key pair associated with a first user 107A; means for transmitting a verification request 121 to a group management system 115, the verification request 121 including an identity 113 of the first user 107A and a group identifier 112 associated with the group 111; means for receiving a confirmation 122 from the group management system 115, the confirmation 122 indicating a membership status of the first user 107A for the group 111 associated with the group identifier 112; and if the confirmation 112 indicates that the first user 107A is a current member of the group 111, means for storing the encrypted secret data 101A', the encrypted secret key 102A', and the encrypted vault key 104' in a vault 109 associated with the group identifier 112.

[0224] Clause Q: The system of clause P, further comprising: when the confirmation indicates that the first user is not a current member of the group, means for restricting storing the encrypted secret data, the encrypted secret key, and the encrypted vault key in the vault.

[0225] Clause R: The system of clauses P and Q, further comprising: means for receiving an access request from a computing device associated with the first user, the access request requesting at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key; means for transmitting a verification request to the group management system, the verification request including the identity of the first user and the group identifier associated with the group and the vault; means for receiving an access confirmation from the group management system, the access confirmation indicating the membership status of the first user for the group associated with the group identifier; and when the access confirmation indicates that the first user is a current member of the group, means for transmitting the encrypted secret data, the encrypted secret key, and the encrypted vault key from the vault to a client computer associated with the first user, wherein the encrypted vault key is configured to be decrypted using a private key of the private-public key pair to generate the vault key.

[0226] Clause S: The system of clauses P-R, further comprising: means for receiving an access request from a computing device associated with the first user, the access request requesting at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key; means for transmitting a verification request to the group management system, the verification request including the identity of the first user and the group identifier associated with the group and the vault; means for receiving an access confirmation from the group management system, the access confirmation indicating the membership status of the first user with respect to the group associated with the group identifier; and means for restricting access to the encrypted secret data, the encrypted secret key, and the encrypted vault key stored in the vault, the restriction invoked in response to receiving the access confirmation indicating that the first user is not a current member of the group.

[0227] Clause T: The system of clauses P-S, further comprising: means for receiving an updated encrypted secret data from a computing device associated with the first user, the updated encrypted data generated on the computing device using the key; means for transmitting a subsequent verification request to the group management system, the subsequent verification request including the identity of the first user and the group identifier associated with the group and the vault; means for receiving a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the membership status of the first user with respect to the group associated with the group identifier; and if the subsequent access confirmation indicates that the first user is a current member of the group, means for storing the updated encrypted secret data in the vault, wherein if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data is restricted from being stored in the vault.

[0228] Based on the foregoing, it will be appreciated that the concepts and technologies for providing enhanced security for encrypted data have been disclosed herein. Although the subject matter presented herein has been described in language specific to computer structural features, methods and transac tions, specific computing machines, and computer readable media, it is to be understood that the application defined in the appended claims is not necessarily limited to the specific features, acts, or media described herein. Rather, the specific features, acts and mediums are disclosed as illustrative forms of implementing the claims.

[0229] The subject matter described above is provided by way of illustration only and should not be construed as limiting. Various modifications and changes can be made to the subject matter described in this specification without following the example exemplary configurations and applications illustrated and described, and without departing from the true spirit and scope of the application as expressed in the appended claims.

[0230] Finally, while various configurations have been described with respect to specific features and / or method actions, it will be understood that the subject matter defined in the appended claims is not necessarily limited to who described specific features or actions. Rather, the specific features and actions are disclosed as example forms of implementing the claimed subject matter.

Claims

1. A method for managing secret data using a vault key for a group of users, the method being performed by a data processing system, comprising: Receive encrypted secret data generated from secret data using a secret key on a remote computing device; Receive an encrypted secret key generated from the secret key using a vault key associated with the user's group; Receive an encrypted vault key generated from the vault key using the public key of the private-public key pair associated with the first user in the user's group; A verification request is sent to the group management system, the verification request including the identity of the first user and a group identifier associated with the group; Receive an acknowledgment from the group management system, the acknowledgment indicating the first user's membership status in the group associated with the group identifier; as well as In response to receiving the confirmation indicating that the first user is a current member of the group, the encrypted secret data, the encrypted secret key, and the encrypted vault key are stored in a vault configured to allow write access to members of the group.

2. The method according to claim 1, further comprising: In response to receiving the confirmation indicating that the first user is not a current member of the group, the storage of the encrypted secret data, the encrypted secret key, and the encrypted vault key in the vault is restricted.

3. The method according to claim 1, further comprising: Receive an access request from a computing device associated with the first user, the access request requesting at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key; In response to the access request, a verification request is sent to the group management system, the verification request including the identity of the first user and the group identifier associated with the group and the vault; Receive an access confirmation from the group management system, the access confirmation indicating the first user's membership status for the group associated with the group identifier; as well as In response to receiving the access confirmation indicating that the first user is a current member of the group, the encrypted secret data, the encrypted secret key, and the encrypted vault key are transmitted from the vault to a client computer associated with the first user, wherein the encrypted vault key is configured to be decrypted using the private key of the private-public key pair to generate the vault key.

4. The method according to claim 1, further comprising: Receive an access request from a computing device associated with the first user, the access request requesting at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key; In response to the access request, a verification request is sent to the group management system, the verification request including the identity of the first user and the group identifier associated with the group and the vault; as well as Receive an access confirmation from the group management system, the access confirmation indicating the first user's membership status for the group associated with the group identifier; as well as In response to receiving the access confirmation indicating that the first user is not a current member of the group, access to the encrypted secret data, the encrypted secret key, and the encrypted vault key stored in the vault is restricted.

5. The method according to claim 1, further comprising: Receive updated encrypted secret data from a computing device associated with the first user, the updated encrypted data being generated on the computing device using the secret key; A follow-up verification request is sent to the group management system, the follow-up verification request including the identity of the first user and the group identifier associated with the group and the vault; Receive a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the first user's membership status for the group associated with the group identifier; as well as If the subsequent access confirmation indicates that the first user is a current member of the group, the updated encrypted secret data is stored in the vault; if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data is restricted to storage in the vault.

6. The method according to claim 1, further comprising: Receive updated encrypted secret data from a computing device associated with the first user, the updated encrypted data being generated on the computing device using an updated secret key; Receive an encrypted updated secret key, the encrypted updated secret key being encrypted from the updated secret key using the vault key; A follow-up verification request is sent to the group management system, the follow-up verification request including the identity of the first user and the group identifier associated with the group and the vault; Receive a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the first user's membership status for the group associated with the group identifier; as well as If the subsequent access confirmation indicates that the first user is a current member of the group, the updated encrypted secret data and the encrypted updated secret key are stored in the vault. If the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data and the encrypted updated secret key are restricted to storage in the vault.

7. The method according to claim 6, further comprising: Receive an updated cryptographic vault key from the computing device associated with the first user, the updated cryptographic vault key being generated from the vault key using an updated public key from an updated private-public key pair associated with the user, wherein the updated cryptographic vault key is configured to decrypt using an updated private key from the updated private-public key pair.

8. The method according to claim 6, further comprising: Receive an updated cryptographic vault key associated with the first user, the updated cryptographic vault key being generated from the vault key using an updated public key from an updated private-public key pair associated with the user; as well as If the subsequent access confirmation indicates that the first user is a current member of the group, the updated encrypted vault key is stored in the vault; if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted vault key is restricted from being stored in the vault.

9. The method according to claim 1, wherein, The vault stores a second encrypted vault key associated with a second user, the second encrypted vault key being configured to be decrypted using a private key associated with the second user to generate the vault key, the method further comprising: Receive an access request from a computing device associated with a second user, the access request requesting the encrypted secret data stored in association with the first user; In response to the access request, a verification request is sent to the group management system, the verification request including the identity of the second user and the group identifier associated with the group and the vault; Receive an access confirmation from the group management system, the access confirmation indicating the second user's membership status with respect to the group; and In response to receiving the access confirmation indicating that the second user is a current member of the group, the encrypted secret data, the encrypted secret key, and the second encrypted vault key are transmitted from the vault to the client computer associated with the second user.

10. The method of claim 9, further comprising: In response to receiving the access confirmation indicating that the first user is not a current member of the group, access to the computing device associated with the second user is restricted to the encrypted secret data, the encrypted secret key, and the encrypted vault key stored in the vault.

11. A computer, comprising: processor; as well as A computer-readable storage medium communicating with the processor, the computer-readable storage medium having computer-executable instructions stored thereon, the computer-executable instructions causing the computer to: Use a secret key to generate encrypted secret data from secret data; An encrypted secret key is generated from the secret key using a vault key associated with the user's group; An encrypted vault key is generated from the vault key using the public key of the private-public key pair associated with the first user in the user's group; as well as The encrypted secret data, the encrypted secret key, and the encrypted vault key are transmitted to the server for storage in the vault. This transmission causes the server to use an acknowledgment from the group manager that defines the membership status of the first user to determine whether the first user is a current member of the group. If the acknowledgment indicates that the first user is a current member of the group, the server allows the first user to store the data in the vault.

12. The computer according to claim 11, wherein, The instructions also cause the computer to perform a process for sharing a single key with multiple devices for a single user, wherein the process includes: Use a symmetric key to encrypt the private key of the private-public key pair to generate an encrypted private key; The symmetric key is transmitted in a security service running on a remote device, wherein the security service provides access to the symmetric key using one or more credentials associated with the first user; and The encrypted private key is transmitted to a secure storage device associated with the operating system of one or more computing devices, wherein the encrypted private key is protected using the one or more credentials associated with the first user.

13. The computer according to claim 11, wherein, The instructions also cause the computer to: Sending an access request to the server to request at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key, wherein the access request causes the server to use a subsequent confirmation from the group manager defining the membership status of the first user to determine whether the first user is a current member of the group; if the subsequent confirmation indicates that the first user is a current member of the group, the server transmits at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key to the computer; and The computer receives at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key.

14. The computer according to claim 11, wherein, The instructions also cause the computer to: Sending an access request to the server to request at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key, wherein the access request causes the server to use a subsequent confirmation from the group manager defining the membership status of the first user to determine whether the first user is a current member of the group; if the subsequent confirmation indicates that the first user is not a current member of the group, the server refuses to transmit at least one of the encrypted secret data, the encrypted secret key, and the encrypted vault key to the computer; and The computer receives a notification indicating the status of the access request.

15. The computer according to claim 11, wherein, The instructions also cause the computer to: The updated secret data is encrypted using the secret key to generate encrypted secret data; A follow-up verification request is sent to the group management system, the follow-up verification request including the identity of the first user and the group identifier associated with the group and the vault; Receive a subsequent access confirmation from the group management system, the subsequent access confirmation indicating the first user's membership status for the group associated with the group identifier; as well as If the subsequent access confirmation indicates that the first user is a current member of the group, the updated encrypted secret data is stored in the vault; if the subsequent access confirmation indicates that the first user is not a current member of the group, the updated encrypted secret data is restricted to storage in the vault.

Images