Systems and methods of cloud encryption
The technology disclosed relates to securely encrypting a document. In particular, it relates to accessing a key-manager with a triplet of organization identifier, application identifier and region identifier and in response receiving a triplet-key and a triplet-key identifier that uniquely identifies the triplet-key. Also, for a document that has a document identifier (ID), the technology disclosed relates to deriving a per-document key from a combination of the triplet-key, the document ID and a salt. Further, the per-document key is used to encrypt the document.
1. A computer-implemented method of monitoring and controlling exfiltration of documents stored on a cloud computing service (CCS), the method including:
using a cross-application monitor to detect
a cloud computing service (CCS) application programming interface (API) in use; and
a function or an activity being performed via the CCS API on a document;
determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content in the document being transmitted to the CCS;
applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control;
providing a triplet of an organization ID of an organization that uses the CCS, a CCS ID, and a region ID as input to a first key-manager, and in response to the input, the first key-manager generating a triplet-key; and
encrypting the document, using a per-document key derived by applying a key derivation function (KDF) to the triplet-key, a document identifier (ID), and a salt, responsive to finding the strings and interrelated strings subject to content control in the parsed stream.
2. The computer-implemented method of claim 1 , further including: transmitting the encrypted document, together with the document ID, the salt, and a triplet-key ID that uniquely identifies the triplet-key, to a recipient to decrypt using a per-document key derived by a second key-manager using the KDF applied to the document ID, the salt, and the triplet-key retrieved using the triplet-key ID.
3. The computer-implemented method of claim 2 , wherein the first and second key-managers are key management interoperability protocol (KMIP) compliant key management systems.
4. The computer-implemented method of claim 1 , wherein the KDF is a hash key derivation function (HKDF).
5. The computer-implemented method of claim 1 , wherein the first key-manager is hosted on-premise at the organization that uses the CCS.
6. A computer-implemented system that monitors and controls exfiltration of documents stored on a cloud computing service (CCS), the system comprising:
a processor and a non-transitory computer readable storage medium storing computer instructions configured to cause the processor to:
use a cross-application monitor to detect
a cloud computing service (CCS) application programming interface (API) in use; and
a function or an activity being performed via the CCS API on a document;
determine the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identify content in the document being transmitted to the CCS;
apply a content inspection rule to find strings and interrelated strings in the content that are subject to content control;
provide a triplet of an organization ID of an organization that uses the CCS, a CCS ID, and a region ID as input to a first key-manager, and in response to the input, the first key-manager generating a triplet-key; and
encrypt the document, using a per-document key derived by applying a key derivation function (KDF) to the triplet-key, a document identifier (ID), and a salt, responsive to finding the strings and interrelated strings subject to content control in the parsed stream.
7. The computer-implemented system of claim 6 , further configured to: transmit the encrypted document, together with the document ID, the salt, and a triplet-key ID that uniquely identifies the triplet-key, to a recipient to decrypt using a per-document key derived by a second key-manager using the KDF applied to the document ID, the salt, and the triplet-key retrieved using the triplet-key ID.
8. The computer-implemented system of claim 7 , wherein the first and second key-managers are key management interoperability protocol (KMIP) compliant key management systems.
9. The computer-implemented system of claim 6 , wherein the KDF is a hash key derivation function (HKDF).
10. The computer-implemented system of claim 6 , wherein the first key-manager is hosted on-premise at the organization that uses the CCS.
11. One or more non-transitory computer readable media having instructions stored thereon for performing a method of monitoring and controlling exfiltration of documents stored on a cloud computing service (CCS), the method including:
using a cross-application monitor to detect
a cloud computing service (CCS) application programming interface (API) in use; and
a function or an activity being performed via the CCS API on a document;
determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content in the document being transmitted to the CCS;
applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control;
providing a triplet of an organization ID of an organization that uses the CCS, a CCS ID, and a region ID as input to a first key-manager, and in response to the input, the first key-manager generating a triplet-key; and
encrypting the document, using a per-document key derived by applying a key derivation function (KDF) to the triplet-key, a document identifier (ID), and a salt, responsive to finding the strings and interrelated strings subject to content control in the parsed stream.
12. The one or more non-transitory computer readable media of claim 11 , implementing the method further comprising: transmitting the encrypted document, together with the document ID, the salt, and a triplet-key ID that uniquely identifies the triplet-key, to a recipient to decrypt using a per-document key derived by a second key-manager using the KDF applied to the document ID, the salt, and the triplet-key retrieved using the triplet-key ID.
13. The one or more non-transitory computer readable media of claim 12 , wherein the first and second key-managers are key management interoperability protocol (KMIP) compliant key management systems.
14. The one or more non-transitory computer readable media of claim 11 , wherein the KDF is a hash key derivation function (HKDF).