Systems and methods for enforcing privacy in cloud security

1. A computer-implemented method for enforcing privacy in cloud security, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying, by the computing device, a set of files in a backup process for a cloud service;

determining, by the computing device, that at least one file in the set of files is a private file by classifying the set of files into private files and public files;

modifying the set of files in the backup process to protect user privacy on the cloud service by encrypting the private file and metadata for the private file;

completing the backup process for the cloud service with the modified set of files;

enforcing a security policy of the cloud service based on a scan of file hashes, wherein:

the scan of file hashes comprises a detection of malware in the scanned file hashes and an identification of a file containing the malware;

the cloud service performs the scan on the file hashes to provide cloud-based security for the public files in the modified set of files; and

encrypting the private file prevents the cloud service from accessing the private file and the metadata for the private file; and

identifying a safe version of the file containing the malware.

2. The method of claim 1 , wherein determining that the file is a private file comprises at least one of:

using a file classifier to classify the content of the file;

identifying a private origin of the file;

determining that a list of known private files of the cloud service includes the file;

receiving confirmation that the file is private from a user of the computing device; and

improving the file classifier based on the received confirmation.

3. The method of claim 2 , wherein using the file classifier to classify the content of the file comprises at least one of:

determining that the file contains personally identifiable information; and

determining that the file contains intellectual information.

4. The method of claim 2 , wherein the private origin of the file comprises at least one of:

a personal device; and

a private file share system.

5. The method of claim 1 , wherein encrypting the metadata for the private file comprises encrypting a file hash of the private file.

6. The method of claim 1 , wherein the scan of file hashes comprises at least one of:

a scan of hashes of the public files in the set of files by the cloud service;

a scan of hashes of public files on the computing device by the cloud service; and

a comparison of scanned file hashes with a file reputation database by the cloud service.

7. The method of claim 1 , wherein enforcing the security policy of the cloud service comprises at least one of:

alerting a user of the computing device about the file containing the malware;

alerting a security program of the computing device about the file containing the malware;

proposing a security solution to mitigate the malware;

executing the security solution to mitigate the malware; and

sending telemetry information about the malware to a central security system for analysis.

8. A system for enforcing privacy in cloud security, the system comprising:

an identification module, stored in memory, that identifies, by a computing device, a set of files in a backup process for a cloud service;

a determination module, stored in memory, that determines, by the computing device, that at least one file in the set of files is a private file by classifying the set of files into private files and public files;

a modification module, stored in memory, that modifies the set of files in the backup process to protect user privacy on the cloud service by encrypting the private file and metadata for the private file;

a completion module, stored in memory, that completes the backup process for the cloud service with the modified set of files;

an enforcement module, stored in memory, that enforces a security policy of the cloud service based on a scan of file hashes, wherein:

the scan of file hashes comprises a detection of malware in the scanned file hashes and an identification of a file containing the malware;

the cloud service performs the scan on the file hashes to provide cloud-based security for the public files in the modified set of files;

encrypting the private file prevents the cloud service from accessing the private file and the metadata for the private file; and

the enforcement module identifies a safe version of the file containing the malware; and

at least one processor that executes the identification module, the determination module, the modification module, the completion module, and the enforcement module.

9. The system of claim 8 , wherein the determination module determines that the file is a private file by at least one of:

using a file classifier to classify the content of the file;

identifying a private origin of the file;

determining that a list of known private files of the cloud service includes the file;

receiving confirmation that the file is private from a user of the computing device; and

improving the file classifier based on the received confirmation.

10. The system of claim 9 , wherein using the file classifier to classify the content of the file comprises at least one of:

determining that the file contains personally identifiable information; and

determining that the file contains intellectual information.

11. The system of claim 9 , wherein the private origin of the file comprises at least one of:

a personal device; and

a private file share system.

12. The system of claim 8 , wherein the modification module encrypts the metadata for the private file by encrypting a file hash of the private file.

13. The system of claim 8 , wherein the scan of file hashes comprises at least one of:

a scan of hashes of the public files in the set of files by the cloud service;

a scan of hashes of public files on the computing device by the cloud service; and

a comparison of scanned file hashes with a file reputation database by the cloud service.

14. The system of claim 8 , wherein the enforcement module enforces the security policy of the cloud service by at least one of:

alerting a user of the computing device about the file containing the malware;

alerting a security program of the computing device about the file containing the malware;

proposing a security solution to mitigate the malware;

executing the security solution to mitigate the malware; and

sending telemetry information about the malware to a central security system for analysis.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, by the computing device, a set of files in a backup process for a cloud service;

determine, by the computing device, that at least one file in the set of files is a private file by classifying the set of files into private files and public files;

modify the set of files in the backup process to protect user privacy on the cloud service by encrypting the private file and metadata for the private file;

complete the backup process for the cloud service with the modified set of files;

enforce a security policy of the cloud service based on a scan of file hashes, wherein:

the scan of file hashes comprises a detection of malware in the scanned file hashes and an identification of a file containing the malware;

the cloud service performs the scan on the file hashes to provide cloud-based security for the public files in the modified set of files; and

encrypting the private file prevents the cloud service from accessing the private file and the metadata for the private file; and

identify a safe version of the file containing the malware.

16. The non-transitory computer-readable medium of claim 15 , wherein the computer-executable instructions cause the computing device to determine that the file is a private file by at least one of:

using a file classifier to classify the content of the file;

identifying a private origin of the file;

determining that a list of known private files of the cloud service includes the file;

receiving confirmation that the file is private from a user of the computing device; and

improving the file classifier based on the received confirmation.

17. The non-transitory computer-readable medium of claim 16 , wherein using the file classifier to classify the content of the file comprises at least one of:

determining that the file contains personally identifiable information; and

determining that the file contains intellectual information.

18. The non-transitory computer-readable medium of claim 16 , wherein the private origin of the file comprises at least one of:

a personal device; and

a private file share system.