Network-based service content protection

1. A method comprising:

forming a service access request configured for communication to a service provider to access content as part of a network-based service;

obtaining a runtime routine from the service provider responsive to the service access request that is configured to permit editing of the content at a computing device;

forming a content access request through execution of the obtained runtime routine on the computing device to obtain the content;

receiving the content on the computing device;

editing the content locally on the computing device through execution of the obtained runtime routine;

automatically encrypting the edited content without any user intervention by the computing device using an encryption credential through execution of the obtained runtime routine and responsive to a request to store the encrypted content at the service provider such that the encrypted content can only be decrypted and accessed with the encryption credential at the computing device;

converting a filename of the content to an associated file identifier to protect the filename and to limit the service provider awareness to only the associated file identifier and the corresponding encrypted content;

storing locally, on the computing device, the filename of the content and the associated file identifier; and

uploading the encrypted content and the associated file identifier to the service provider.

2. The method as described in claim 1 , wherein the encrypting is performed through use of the encryption credential that includes one or more cryptographic keys stored locally at the computing device.

3. The method as described in claim 2 , wherein the one or more cryptographic keys are manually entered by a user at the computing device responsive to a prompt to decrypt the encrypted content.

4. The method as described in claim 2 , wherein the one or more cryptographic keys are obtained from a third-party service that is accessible via a network, the one or more cryptographic keys not being directly accessible by the service provider from the third-party service.

5. The method as described in claim 2 , wherein the one or more cryptographic keys are stored locally at the computing device in secure storage such that the one or more cryptographic keys are not exposed outside of the computing device.

6. The method as described in claim 1 , further comprising decrypting the content obtained from the service provider.

7. A method comprising:

forming a service access request configured for communication to a service provider via a network to access encrypted content as part of a network-based service;

obtaining a runtime routine via the network from the service provider responsive to the service access request from a computing device;

forming a content access request through execution of the obtained runtime routine on the computing device to obtain encrypted content responsive to receipt of the service request by the service provider;

obtaining the encrypted content via the network by the computing device through execution of the obtained runtime routine, the encrypted content made available via a network-based service by the service provider responsive to receipt of the content access request;

decrypting the encrypted content for access locally at the computing device through execution of the obtained runtime routine;

managing the local access to the decrypted content by the computing device to edit the decrypted content such that responsive to a request to communicate the decrypted content outside of the computing device, the decrypted content is encrypted automatically and without user intervention through execution of the obtained runtime routine;

converting a filename of the decrypted content to an associated file identifier to protect the filename and to limit the service provider awareness to only the associated file identifier and the corresponding encrypted content; and

storing locally, on the computing device, the filename of the content and the associated file identifier.

8. The method as described in claim 7 , wherein the decrypted content is encrypted automatically and without user intervention through use of one or more cryptographic keys stored locally at the computing device.

9. The method as described in claim 8 , wherein the one or more cryptographic keys are manually entered by a user responsive to a prompt to decrypt the obtained encrypted content.

10. The method as described in claim 8 , wherein the one or more cryptographic keys are obtained from a third-party service that is accessible via the network, the one or more cryptographic keys not being directly accessible by the service provider from the third-party service.

11. The method as described in claim 8 , wherein the one or more cryptographic keys are stored locally at the computing device in secure storage such that the one or more cryptographic keys are not exposed outside of the computing device.

12. The method as described in claim 7 , wherein the network-based service is configured to permit access to the content that includes editing of the content.

13. The method as described in claim 7 , wherein the content is a document, spreadsheet, presentation, music, or graphic.

14. A method comprising:

forming a service access request configured for communication to a service provider to access content as part of a network-based service;

obtaining a runtime routine from the service provider responsive to the service access request that is configured to permit editing of the content at a computing device;

forming a content access request through execution of the runtime routine on the computing device to obtain the content;

receiving the content on the computing device;

accessing the content locally at the computing device through execution of the runtime routine;

converting a filename of the content to an associated file identifier to protect the filename and to limit the service provider awareness to only the associated file identifier and corresponding encrypted content;

storing locally, on the computing device, the filename of the content and the associated file identifier; and

responsive to a request to expose the content external to the computing device back to the service provider via the network, encrypting the content automatically and without user intervention using one or more cryptographic keys that are not accessible by the service provider through execution of the obtained runtime routine.

15. The method as described in claim 14 , wherein the cryptographic keys are stored locally at the computing device.

16. The method as described in claim 15 , wherein the one or more cryptographic keys are manually entered by a user responsive to a prompt to decrypt the encrypted content.

17. A system comprising:

at least one module implemented at least partially in hardware, the at least one module configured to expose a runtime routine received from a service provider that is executable locally at a computing device to edit content in association with one or more network-based services of the service provider, the runtime routine configured to protect the content automatically and without user intervention from access by the service provider;

one or more modules implemented at least partially in hardware, the one or more modules configured to:

store the content encrypted by the runtime routine automatically and without user intervention such that the content is not accessible by the service provider;

convert a filename of the content to an associated file identifier to protect the filename and to limit the service provider awareness to only the associated file identifier and the corresponding encrypted content; and

store locally, on the computing device, the filename of the content and the associated file identifier.

18. The system as described in claim 17 , wherein the content is protected using one or more cryptographic keys.

19. The system as described in claim 18 , wherein the one or more cryptographic keys are manually entered by a user responsive to a prompt to decrypt the encrypted content.

20. The system as described in claim 18 , wherein the one or more cryptographic keys are obtained from a third-party service that is accessible via a network, the one or more cryptographic keys not being directly accessible by the service provider from the third-party service.

21. The system as described in claim 17 , wherein the content is a document, spreadsheet, presentation, music, or graphic.

22. The system as described in claim 17 , wherein the dynamic runtime routine is exposed for availability by the service provider responsive to a request to obtain the content.