Cloud Document Encryption via Authentication Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based solutions like G Suite are vulnerable to security breaches and data leaks due to user error, particularly when sharing confidential information with third parties, as there is no way to ensure that decrypted documents are not accessed by unintended recipients.
Innovation Solution
Implementing a method where encrypted documents are stored on a cloud computing network, allowing only authorized users to access a decrypted version after authentication, ensuring that only an encrypted version is shared via a public link, and encrypting edited documents back into the user's account to maintain security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If URLs are shared to allow easy document access, then ease of operation is improved, but security is worsened because unintended recipients can access confidential documents
Solution Approach 1:
The system performs preliminary authentication of the second user before granting access to the decrypted document. The authentication service verifies the user's identity and authorization status in advance, ensuring that only authorized users can access confidential information while maintaining easy URL sharing capabilities
Solution Approach 2:
An authentication service acts as an intermediary between the user and the decrypted document. This intermediary service verifies user credentials and authorization before allowing access, thereby maintaining both ease of operation through URL sharing and security through controlled access
2Reliability
If encrypted documents are stored in the cloud to improve security, then reliability is improved, but ease of operation is worsened because users cannot easily collaborate on decrypted versions
Solution Approach 1:
The system dynamically manages document encryption states based on user authentication and authorization. Encrypted documents are temporarily decrypted in memory for authorized users to collaborate, then re-encrypted and stored back in the cloud. This dynamic approach maintains security while enabling collaboration
Solution Approach 2:
The system maintains continuous encryption protection for stored documents while providing temporary decryption for authorized collaboration. The encrypted version remains in the cloud storage continuously, while decrypted versions are created temporarily in memory for collaboration, ensuring security is never broken but collaboration is enabled
3Reliability
If authentication is required to access decrypted documents, then security is improved, but productivity is worsened due to additional login steps
Solution Approach 1:
The authentication service provides multiple authentication methods and integrates with existing cloud service accounts. Users can authenticate through various means (password, SSO, MFA) depending on their needs, and the system caches authentication results to reduce repeated login requirements, maintaining security while minimizing productivity impact
Data Source
AI summary
A method of allowing collaboration on an encrypted document stored in a cloud computing network, the encrypted document associated with a first user having a first user account in the cloud computing network, the method comprising: in response to a request from the first user to share the encrypted document, sending a link to a public network destination to a second user address of a second user; receiving a request via the link from an unconfirmed user to access the data in the encrypted document; requesting of the unconfirmed user to login to a second user account on the cloud computing network; authenticating the identity of the unconfirmed user as the second user; upon authenticating the identity of the unconfirmed user as the second user, decrypting the encrypted document to generate a decrypted document; storing the decrypted document in the first user account; granting the second user access to the decrypted file simultaneously to access granted to the first user; subsequent to the first user or the second user editing the decrypted document, encrypting an edited version of the decrypted document; and storing the edited version of the encrypted document in the first user account.