Tokenized Cloud Document Editing for Secure Third-Party Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud services store data in plaintext, leading to loss of control for data owners, making it vulnerable to theft, system failures, and legal subpoenas, causing businesses to resist or limit their use of cloud services.
Innovation Solution
A method that tokenizes files before transmission to a cloud editing provider, allowing editing without exposing plaintext data, using encryption and a tokenization seed to ensure secure data handling and rendering, with de-tokenization occurring on the user's browser to maintain confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in plaintext in cloud services, then ease of access and processing is improved, but data security and control are worsened
Solution Approach 1:
The patent introduces a tokenization intermediary layer between the cloud storage provider and the cloud editing provider. The tokenization service converts plaintext data into tokens before transmission to the editing provider, and converts tokens back to plaintext before delivery to the user. This intermediary mechanism allows the editing provider to process data without accessing the actual plaintext, resolving the contradiction between ease of access and data security.
Solution Approach 2:
The patent segments the data processing function into separate components: a tokenization service that handles encryption/tokenization, a cloud editing provider that handles processing, and a user interface that handles display. By segmenting these functions, the system allows secure data processing without requiring the editing provider to store or access plaintext, thus maintaining both accessibility and security.
2Reliability
If data is tokenized before transmission to cloud editing provider, then data security is improved, but system complexity is worsened
Solution Approach 1:
The tokenization service operates autonomously as a self-contained component that handles all encryption and decryption operations automatically. The service manages its own key storage, token generation, and token conversion without requiring manual intervention or complex configuration. This self-service approach simplifies the overall system architecture by encapsulating complexity within a single service component.
Solution Approach 2:
The patent uses tokenization as a form of data copying where the original plaintext data is replaced with token representations. The tokenization service creates a copy of the data in token form for transmission and processing, while the original plaintext remains securely stored. This copying mechanism simplifies the system by allowing the editing provider to work with tokens without needing direct access to the original data structure.
3Productivity
If tokenization is performed on raw data component only, then processing efficiency is improved, but data completeness is worsened
Solution Approach 1:
The patent segments the document into two distinct components: a raw data component that is tokenized for secure processing, and a formatting component that is not tokenized and remains intact. This segmentation allows the system to maintain processing efficiency by tokenizing only the necessary data portions while preserving formatting information, thus avoiding loss of data completeness.
Solution Approach 2:
The patent applies different processing qualities to different parts of the data: tokenization is applied locally to the raw data component where security is needed, while the formatting component maintains its original quality and structure. This local quality approach ensures that tokenization enhances security without compromising the completeness or integrity of the overall document structure.
Data Source
AI summary
Systems and methods for secure third-party document editing are described. In some embodiments, a method may include tokenizing a file retrieved from a cloud storage provider (CSP); transmitting the tokenized file to a cloud editing provider (CEP); receiving a modified, tokenized file from the CEP; de-tokenizing the modified file; and enabling rendering of the de-tokenized, modified file. In other embodiments, a memory device may have program instructions stored thereon that, upon execution by a processor of an Information Handling System (IHS), cause the IHS to: provide a portal to a user executing a browser on a client device, wherein the portal includes an interface to a CSP and to a cloud editing provider (CDEP); and allow the user to access a document stored in the CSP and to edit the document using the CDEP via the browser.