Encrypted Document Collaboration Without Server Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud-based content management platforms lack a protection mechanism to prevent unauthorized access and interception of document contents during online collaboration, making them vulnerable to security breaches.
Innovation Solution
Documents are stored and edited in an encrypted form, with the server unable to decrypt them, ensuring that only authorized collaborators can access the encrypted data through a secure collaboration component and key management system, maintaining confidentiality and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If documents are stored in encrypted form at cloud-based storage system, then data security is improved, but the server cannot access or process the document content
Solution Approach 1:
The system segments the encryption key management from the storage system. The cloud-based storage system stores only encrypted document data without the decryption keys, while a separate key management system securely handles the keys. This segmentation allows the storage system to maintain security (encrypted data) while enabling authorized access through the key management system when needed.
Solution Approach 2:
The patent introduces an intermediary key management system that acts as a mediator between the encrypted storage system and authorized users. When document access is required, the key management system provides decryption keys to authorized users without exposing keys to the storage system itself. This intermediary enables secure access while maintaining the security architecture.
2Device complexity
If encryption keys are managed centrally at the server, then key distribution is simplified, but security is reduced as the server gains access to decrypted content
Solution Approach 1:
The system separates key management functions from the storage server. Instead of the server holding all encryption keys, the patent implements a dedicated key management system that securely stores and distributes keys. This segmentation reduces the security risk at the server level while maintaining simplified key distribution through the specialized key management infrastructure.
Solution Approach 2:
The patent extracts the decryption keys from the storage system entirely. Keys are removed from the cloud-based storage server and managed separately in a secure key management system. This extraction ensures the server cannot access decrypted content while still enabling key distribution to authorized users through the key management system.
3Productivity
If collaborative editing is enabled in real-time, then productivity is improved, but security risks increase due to multiple access points
Solution Approach 1:
The system implements local quality control by providing different access levels and encryption key permissions to different collaborators. Each user receives appropriate decryption keys based on their authorization level, allowing real-time collaborative editing while maintaining granular security control. The key management system distributes keys selectively to enable collaboration without exposing all content to all users.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method for secure online collaboration is provided. The method includes receiving, at a server of a cloud-based storage system, first encrypted data from a first client device. The cloud-based storage system stores a plurality of documents in an encrypted form. The method also includes determining a document of the plurality of documents that is associated with the first encrypted data. The document is not accessible to the server in a decrypted form. The first encrypted data represents an edit to a portion of the document. The method further includes determining a plurality of user accounts of collaborators of the document. The plurality of user accounts includes a first user account associated with the first client device. Moreover, the method includes providing the first encrypted data to one or more other client devices that are each associated with one of the plurality of user accounts, excluding the first user account.