Systems and methods of per-document encryption of enterprise information stored on a cloud computing service (CCS)

1. A computer-implemented method of securely transmitting a document encrypted using a per-document key, the method including:

sending, by a security engine, a key-and-identifier request, including a triplet of organization identifier, application identifier and region identifier, to a first key-manager module, wherein the first key-manager module is one of multiple key-manager modules distributed across a plurality of points of presence that maintain and share key-derivation information;

receiving, by the security engine, a key-and-identifier response, including a triplet-key used to derive per document encryption keys and a triplet-key identifier used to uniquely identify the triplet-key, from the first key-manager module;

invoking, by the security engine, a crypto module with the triplet-key, a document identifier (ID), and a salt and causing the crypto module to encrypt the document, including deriving a per-document key using a key derivation function (KDF) applied to the triplet-key, the document ID, and the salt, and then encrypting the document using the derived per-document key; and

transmitting the encrypted document, together with the document ID, the salt, and the triplet-key identifier, to a recipient to decrypt using a per-document key derived by a second key-manager module using the KDF applied to the document ID, the salt, and the triplet-key, the triplet-key retrieved using the triplet-key identifier.

2. The computer-implemented method of claim 1 , wherein:

the KDF is a hash key derivation function (HKDF).

3. The computer-implemented method of claim 1 , further including:

applying a document classification tag to the document based on content inspection of the document; and

using the document classification tag to control access to the document.

4. The computer-implemented method of claim 1 , further including:

generating a data integrity tag that authenticates integrity of the document; and

persisting the data integrity tag for use during further processing of the document.

5. The computer-implemented method of claim 1 , wherein:

the key-manager modules are key management interoperability protocol (KMIP) compliant key management systems.

6. The computer-implemented method of claim 1 , wherein:

the first key-manager module is hosted at a local data center of an organization that uses a cloud computing service (CCS).

7. A computer-implemented method of securely decrypting a document, the method including:

sending, by a security engine, a triplet-key request, including a triplet-key identifier used to uniquely identify a triplet key associated with a triplet of organization identifier, application identifier and region identifier, to a first key-manager module, wherein the first key-manager module is one of multiple key-manager modules distributed across a plurality of points of presence that maintain and share key-derivation information;

receiving, by the security engine, a key response, including a triplet-key used to derive per document encryption keys and corresponding to the triplet-key identifier, from the first key-manager module;

invoking, by the security engine, a crypto module with the triplet-key, a document identifier (ID), and a salt and causing the crypto module to decrypt the document, including deriving a per-document key using a key derivation function (KDF) applied to the triplet-key, the document ID, and the salt, and then decrypting the document using the derived per-document key; and

transmitting the decrypted document to a recipient to use.

8. The computer-implemented method of claim 7 , further including:

prior to the sending, authorizing a user for decryption based on a plurality of condition variables, wherein the plurality of condition variables includes at least one data classification tag of the document to be decrypted.

9. The computer-implemented method of claim 7 , wherein:

deriving the per-document key from the combination of the triplet-key, the document ID and the salt further includes using a hash key derivation function (HKDF).

10. The computer-implemented method of claim 7 , further including:

verifying a data integrity tag, associated with the document, that authenticates integrity of the document.

11. The computer-implemented method of claim 7 , wherein:

the triplet-key identifier includes at least one of an organization identifier and an application identifier.

12. The computer-implemented method of claim 7 , wherein:

the key-manager modules are key management interoperability protocol (KMIP) compliant key management systems.

13. The computer-implemented method of claim 7 , wherein:

the first key-manager module is hosted at a local data center of an organization that uses a cloud computing service (CCS).

14. A computer-implemented system that securely encrypts a document, the system including:

a processor and a computer readable storage medium storing computer instructions configured to cause the processor to:

send, by a security engine, a key-and-identifier request, including a triplet of organization identifier, application identifier and region identifier, to a first key-manager module, wherein the first key-manager module is one of multiple key-manager modules distributed across a plurality of points of presence that maintain and share key-derivation information;

receive, by the security engine, a key-and-identifier response, including a triplet-key used to derive per document encryption keys and a triplet-key identifier used to uniquely identify the triplet-key, from the first key-manager module;

invoke, by the security engine, a crypto module with the triplet-key, a document identifier (ID), and a salt and causing the crypto module to encrypt the document, including deriving a per-document key using a key derivation function (KDF) applied to the triplet-key, the document ID, and the salt, and then encrypting the document using the derived per-document key; and

transmit the encrypted document, together with the document ID, the salt, and the triplet-key identifier, to a recipient to decrypt using a per-document key derived by a second key-manager module using the KDF applied to the document ID, the salt, and the triplet-key, the triplet-key retrieved using the triplet-key identifier.

15. The computer-implemented system of claim 14 , wherein:

the KDF is a hash key derivation function (HKDF).

16. The computer-implemented system of claim 14 , wherein the computer instructions configured to cause the processor to:

apply a document classification tag to the document based on content inspection of the document; and

use the document classification tag to control access to the document.

17. The computer-implemented system of claim 14 , wherein the computer instructions configured to cause the processor to:

generate a data integrity tag that authenticates integrity of the document; and

persist the data integrity tag for use during further processing of the document.

18. The computer-implemented system of claim 14 , wherein:

the key-manager modules are key management interoperability protocol (KMIP) compliant key management systems.

19. The computer-implemented system of claim 14 , wherein:

the first key-manager module is hosted at a local data center of an organization that uses a cloud computing service (CCS).

20. A computer-implemented system that securely decrypts a document, the system including:

a processor and a non-transitory computer readable storage medium storing computer instructions configured to cause the processor to:

send, by a security engine, a triplet-key request, including a triplet-key identifier used to uniquely identify a triplet key associated with a triplet of organization identifier, application identifier and region identifier, to a first key-manager module, wherein the first key-manager module is one of multiple key-manager modules distributed across a plurality of points of presence that maintain and share key-derivation information;

receive, by the security engine, a key response, including a triplet-key used to derive per document encryption keys and corresponding to the triplet-key identifier, from the first key-manager module;

invoke, by the security engine, a crypto module with the triplet-key, a document identifier (ID), and a salt and causing the crypto module to decrypt the document, including deriving a per-document key using a key derivation function (KDF) applied to the triplet-key, the document ID, and the salt, and then decrypting the document using the derived per-document key; and

transmit the decrypted document to a recipient to use.

21. The computer-implemented system of claim 20 , wherein the computer instructions configured to cause the processor, prior to sending a triplet-key request, to authorize a user for decryption based on a plurality of condition variables, wherein the plurality of condition variables includes at least one data classification tag of the document to be decrypted.

22. The computer-implemented system of claim 20 , wherein the computer instructions configured to cause the processor to verify a data integrity tag, associated with the document, that authenticates integrity of the document.

23. One or more non-transitory computer readable media having instructions stored thereon for performing a method of securely transmitting a document encrypted using a per-document key, the method including:

sending, by a security engine, a key-and-identifier request, including a triplet of organization identifier, application identifier and region identifier, to a first key-manager module, wherein the first key-manager module is one of multiple key-manager modules distributed across a plurality of points of presence that maintain and share key-derivation information;

receiving, by the security engine, a key-and-identifier response, including a triplet-key used to derive per document encryption keys and a triplet-key identifier used to uniquely identify the triplet-key, from the first key-manager module;

invoking, by the security engine, a crypto module with the triplet-key, a document identifier (ID), and a salt and causing the crypto module to encrypt the document, including deriving a per-document key using a key derivation function (KDF) applied to the triplet-key, the document ID, and the salt, and then encrypting the document using the derived per-document key; and

transmitting the encrypted document, together with the document ID, the salt, and the triplet-key identifier, to a recipient to decrypt using a per-document key derived by a second key-manager module using the KDF applied to the document ID, the salt, and the triplet-key, the triplet-key retrieved using the triplet-key identifier.

24. One or more non-transitory computer readable media having instructions stored thereon for performing a method of securely decrypting a document, the method including:

sending, by a security engine, a triplet-key request, including a triplet-key identifier used to uniquely identify a triplet key associated with a triplet of organization identifier, application identifier and region identifier, to a first key-manager module, wherein the first key-manager module is one of multiple key-manager modules distributed across a plurality of points of presence that maintain and share key-derivation information;

receiving, by the security engine, a key response, including a triplet-key used to derive per document encryption keys and corresponding to the triplet-key identifier, from the first key-manager module;

invoking, by the security engine, a crypto module with the triplet-key, a document identifier (ID), and a salt and causing the crypto module to decrypt the document, including deriving a per-document key using a key derivation function (KDF) applied to the triplet-key, the document ID, and the salt, and then decrypting the document using the derived per-document key; and

transmitting the decrypted document to a recipient to use.