Modifiable client-side encrypted data in the cloud
Particular embodiments described herein provide for a system that can be configured to receive a notification that a client device is requesting, to modify original data associated with an online application, wherein the original data is stored in encrypted format in a cloud; decrypt the original data using a first client encryption key; store the decrypted data in a location accessible by the online application; enable editing capability of the decrypted data; receive a notification that the client device is finished modifying the data in decrypted format; determine whether the original data in decrypted format was modified; encrypt, based on a determination that the original data was modified, the modified data using a second client encryption key; and upload the modified data in encrypted format to the cloud.
1. At least one non-transitory machine-readable medium comprising one or more instructions that when executed by a processor, cause the processor to:
receive a notification that a client device is requesting to access client-side encrypted data associated with an online application stored in a cloud service provider, wherein the client-side encrypted data is encrypted by a client-authorized device using a first client encryption key;
download, by the client-authorized device, the client-side encrypted data;
decrypt, by the client-authorized device, the client-side encrypted data using the first client encryption key;
store the client-side decrypted data in the cloud service provider in a location accessible by the online application;
enable access, by the client device, to the client-side decrypted data stored in the cloud service provider;
receive a notification that the client device finished accessing the client-side decrypted data;
download, by the client-authorized device in response to receiving the notification, the client-side decrypted data stored in the cloud service provider;
encrypt, by the client-authorized device, the downloaded client-side decrypted data using a second client encryption key; and
upload the client-side encrypted data that was encrypted using the second encryption key to the cloud service provider, wherein the client-side encrypted data that was encrypted using the second encryption key replaces the client-side encrypted data that was encrypted using the first encryption key stored in the cloud.
2. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the processor, cause the processor to:
delete the client-side decrypted data from the location accessible by the online application in the cloud service provider.
3. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the processor, cause the processor to:
determine whether the client-side decrypted data was modified.
4. The at least one non-transitory machine-readable medium of claim 1 , wherein the client device accesses the client-side decrypted data using an in-browser web application hosted by the cloud service provider via a user extension application.
5. The at least one non-transitory machine-readable medium of claim 1 , wherein the client device accesses the client-side decrypted data using an in-browser web application hosted by the cloud service provider, and wherein the in-browser web application is launched by a web application hosted on a different platform from the cloud service provider.
6. The at least one non-transitory machine-readable medium of claim 1 , wherein the client-side decrypted data is stored in a temporary location in the cloud service provider.
7. The at least one non-transitory machine-readable medium of claim 6 , wherein the location of the client-side decrypted data is not visible to the client device.
8. At least one non-transitory machine-readable medium comprising one or more instructions that when executed by a processor, cause the processor to:
receive a notification that a client device is requesting to modify original data associated with an online application, wherein the original data is encrypted by a client-authorized device using a first client encryption key and is stored in client-side encrypted format in a cloud;
decrypt, by the client-authorized device, the original data using the first client encryption key;
store, by the client-authorized device, the decrypted data in a location accessible by the online application;
enable editing capability of the decrypted data;
receive, by the client-authorized device, a notification that the client device finished editing the decrypted data;
determine, by the client-authorized device, whether the original data in decrypted format was modified;
encrypt, by the client-authorized device based on a determination that the original data was modified, the modified data using a second client encryption key; and
upload, by the client-authorized device, the modified data in client-side encrypted format to the cloud, wherein the modified data replaces the original data stored in the cloud.
9. The at least one non-transitory machine-readable medium of claim 8 , further comprising one or more instructions that when executed by the processor, cause the processor to:
delete the data in decrypted format from the location accessible by the online application.
10. The at least one non-transitory machine-readable medium of claim 8 , wherein the online application is an in-browser web application, and wherein the in-browser web application is launched by a web application not hosted on a same platform as the cloud.
11. The at least one non-transitory machine-readable medium of claim 8 , wherein the data in decrypted format is stored in a temporary location in the cloud.
12. The at least one non-transitory machine-readable medium of claim 8 , wherein the first client encryption key and the second client encryption key are the same.
13. The at least one non-transitory machine-readable medium of claim 8 , wherein the first client encryption key and the second client encryption key are different.
14. A method comprising:
receiving a notification that a client device is requesting to modify original data associated with an online application, wherein the original data is encrypted by a client-authorized device using a first client encryption key and is stored in encrypted format in a cloud;
downloading, by the client-authorized device, the original data;
decrypting, by the client-authorized device, the original data using the first client encryption key;
storing, by the client-authorized device, the decrypted data in a location accessible by the online application;
enabling editing capability of the decrypted data;
receiving, by the client-authorized device, a notification that the client device is finished modifying the data in decrypted format;
determining, by the client-authorized device, whether the original data in decrypted format was modified;
encrypting, by the client-authorized device based on a determination that the original data was modified, the modified data using a second client encryption key; and
uploading, by the client-authorized device, the modified data in encrypted format to the cloud, wherein the modified data replaces the original data stored in the cloud.
15. The method of claim 14 , further comprising:
deleting the data in decrypted format from the location accessible by the online application.
16. The method of claim 14 , wherein the data in decrypted format is stored in the cloud.
17. The method of claim 14 , wherein the location of the data in decrypted format is not visible to the client device.
18. A system for migrating a secure domain, the system comprising:
memory; and
at least one processor implemented in hardware configured to:
receive a notification that a client device is requesting to modify original data associated with an in-browser web application, wherein the original data is encrypted by a client-authorized device using a first client encryption key and is stored in encrypted format in a cloud;
download, by the client-authorized device, the encrypted data;
decrypt, by the client-authorized device, the original data using the first client encryption key;
store, by the client-authorized device, the decrypted data in a location accessible by the in-browser web application;
enable editing capability of the decrypted data;
receive a notification that the client device finished modifying the decrypted data;
determine whether the original data in decrypted format was modified;
encrypt, by the client-authorized device based on a determination that the original data was modified, the modified data using a second client encryption key; and
upload the modified data in encrypted format to the cloud, wherein the modified data replaces the original data stored in the cloud.
19. The system of claim 18 , wherein the at least one processor is further configured to:
delete the data in decrypted format from the location accessible by the in-browser web application.
20. The system of claim 18 , wherein the at least one processor is further configured to:
classify the modified data prior to encryption.
21. The system of claim 18 , wherein the data in decrypted format is stored in the cloud.
22. The system of claim 18 , wherein the at least one processor is further configured to:
determine whether the cloud is trusted.