File Sync Privacy via Segmented Key Management

The patent introduces a key management service as an intermediary between users and their encryption keys. This service handles key generation, storage, rotation, and distribution automatically, eliminating the need for users to directly manage complex cryptographic keys while maintaining strong encryption. The intermediary absorbs the operational complexity, allowing users to benefit from robust privacy without the burden of key management.

The key management service operates autonomously to perform security functions without requiring user intervention. It automatically manages the encryption keys for user files, handles key rotation, and ensures secure access without user involvement in the technical details. This self-service approach resolves the contradiction by providing strong encryption while completely removing the operational burden from users.

The patent segments the encryption key hierarchy into multiple levels: a root managed key at the organization level, child keys for different departments or teams, and leaf keys for individual files. This segmentation allows the root key to remain secure and controlled by the key management service while enabling selective sharing of child keys or file keys with external partners. The segmented structure resolves the contradiction by maintaining centralized control for privacy while enabling flexible adaptability for external collaboration.

The key management system dynamically adjusts key access permissions based on sharing requirements. When external collaboration is needed, the system can temporarily grant access to specific child keys or file keys to external users without compromising the root managed key. This dynamic key access control allows the system to adapt to external sharing needs while maintaining the security benefits of managed encryption keys.

The key management service acts as an intermediary that mediates between the key owner and the invitee. Instead of directly sharing the personal encryption key, the system provides secure key exchange mechanisms where the invitee can obtain access to specific files or folders without receiving the master key. The intermediary handles the sensitive key exchange process, maintaining security while enabling sharing capability.

The patent extracts the encryption key from the file data structure, separating the key management function from the data storage function. Files are stored encrypted with keys that are managed independently by the key management service. This extraction allows the system to provide file access to invitees without transferring the master encryption key, maintaining key security while enabling sharing. The key is extracted and managed separately, allowing selective disclosure of data without compromising the key.