Systems and methods for zero-knowledge enterprise collaboration
Systems and methods for zero-knowledge enterprise collaboration are provided herein. In some embodiments, the method may comprise receiving, at a host server, a request to store a file, wherein the file is encrypted with a data key prior to being received at the host server; receiving a request to perform a first service; determining whether the first service is authorized to access the file, wherein determining comprises unwrapping the data key with the private key of the first service; providing access to the first service when the private key of the first service successfully unwraps the data key for the file; and storing the encrypted file.
1. A computer-implemented method for accessing an encrypted file by a user of a user computer in a zero-knowledge enterprise collaboration, comprising:
requesting an encrypted file from a host server;
receiving the encrypted file and an encrypted key pair, wherein the encrypted key pair comprises an encrypted data key and a private key of the user;
deriving a key from a password of the user of the user computer to unwrap the encrypted key pair;
decrypting a data key of the file using the private key of the user; and
opening the file using the decrypted data key.
2. The method of claim 1 , wherein the encrypted file is encrypted with a data key, and wherein the data key is encrypted with a public key of the user.
3. The method of claim 1 , wherein the key pair comprises the data key for the file encrypted with a public key of the user, and the private key of the user.
4. A system for zero-knowledge enterprise collaboration, comprising:
a plurality of encrypted files stored on a host server, the host server comprising:
a) at least one processor;
b) at least one input device; and
c) at least one storage device storing processor executable instructions which, when executed by the at least one processor, perform a method to:
receive, at the host server, a request to store a file, wherein the file is encrypted with a data key prior to being received at the host server;
receive a request to perform a first service;
determine whether the first service is authorized to access the file, wherein determining comprises unwrapping the data key with a private key of the first service;
provide access to the first service when the private key of the first service successfully unwraps the data key for the file; and
store the encrypted file; and
a plurality of user computers, each user computer comprising:
a) at least one processor;
b) at least one input device; and
c) at least one storage device storing processor executable instructions which, when executed by the at least one processor, perform a method to:
request the encrypted file from a host server;
receive the encrypted file and an encrypted key pair, wherein the encrypted key pair comprises the encrypted data key and the private key of the user;
derive a key from a password of the user of the user computer to unwrap the encrypted key pair;
decrypt a data key of the file using the private key of the user; and
open the file using the decrypted data key.
5. The method of claim 4 , wherein the encrypted file is encrypted with a data key, and wherein the data key is encrypted with a public key of the user.
6. The method of claim 4 , wherein the encrypted key pair comprises the data key for the file encrypted with a public key of the user, and the private key of the user.
7. The system of claim 4 , wherein the processor executable instructions which, when executed by the at least one processor, perform the method further comprising:
receive a request to perform a second service;
determine whether the second service is authorized to access the file, wherein determining comprises unwrapping the data key with the private key of the second service; and
deny access to the second service when the private key of the second service fails to unwrap the data key for the file.
8. The method of claim 4 , wherein the data key is encrypted using a public key of each of one or more services on the host server that are authorized to access the file.