Modifiable client-side encrypted data in the cloud
Particular embodiments described herein provide for a system that can be configured to receive a notification that a client device is requesting, to modify original data associated with an online application, wherein the original data is stored in encrypted format in a cloud; decrypt the original data using a first client encryption key; store the decrypted data in a location accessible by the online application; enable editing capability of the decrypted data; receive a notification that the client device is finished modifying the data in decrypted format; determine whether the original data in decrypted format was modified; encrypt, based on a determination that the original data was modified, the modified data using a second client encryption key; and upload the modified data in encrypted format to the cloud.
1. At least one non-transitory machine-readable medium comprising one or more instructions that when executed by a processor, cause the processor to:
receive a notification that a client device is requesting to access client-side encrypted data associated with an online application stored in a cloud service provider, wherein the client-side encrypted data has been encrypted by a client-authorized device using a first client encryption key;
decrypt, by the client-authorized device, the client-side encrypted data using the first client encryption key;
store the client-side decrypted data in a temporary location in the cloud service provider;
enable access, by the client device and by the online application, to the client-side decrypted data while stored in the cloud service provider;
encrypt, by the client-authorized device, after the client device finishes accessing the client-side decrypted data, the client-side decrypted data using a second client encryption key; and
upload, by the client-authorized device, the client-side encrypted data that was encrypted using the second encryption key to the cloud service provider to replace the client-side encrypted data that was encrypted using the first encryption key.
2. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the processor, cause the processor to:
delete the client-side decrypted data.
3. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the processor, cause the processor to:
determine whether the client-side decrypted data was modified.
4. The at least one non-transitory machine-readable medium of claim 1 , wherein the client device accesses the client-side decrypted data using an in-browser web application hosted by the cloud service provider via a user extension application.
5. The at least one non-transitory machine-readable medium of claim 1 , wherein the client device accesses the client-side decrypted data using an in-browser web application hosted by the cloud service provider, and wherein the in-browser web application is launched by a web application hosted on a different platform from the cloud service provider.
6. The at least one non-transitory machine-readable medium of claim 1 , wherein the location of the client-side decrypted data is not visible to the client device.
7. The at least one non-transitory machine-readable medium of claim 1 , further comprising one or more instructions that when executed by the processor, cause the processor to:
determine whether the cloud service provider is trusted.
8. At least one non-transitory machine-readable medium comprising one or more instructions that when executed by a processor, cause the processor to:
receive a notification that a client device is requesting to modify original data associated with an online application, wherein the original data has been encrypted by a client-authorized device using a first client encryption key and is stored in client-side encrypted format in a cloud;
decrypt, by the client-authorized device, the original data using the first client encryption key;
store the original data in decrypted format in a temporary location in the cloud;
enable, by the client device and the online application, access to the original data in decrypted format while stored in the cloud;
determine, by the client-authorized device, after the client device finishes accessing the original data in decrypted format, whether the original data in decrypted format was modified; and
delete, by the client-authorized device, based on a determination that the original data in decrypted format was not modified, the original data in decrypted format.
9. The at least one non-transitory machine-readable medium of claim 8 , further comprising one or more instructions that when executed by the processor, cause the processor to:
encrypt, by the client-authorized device based on a determination that the original data was modified, the modified data using a second client encryption key; and
upload, by the client-authorized device, the modified data in client-side encrypted format to the cloud to replace the original data stored in the cloud.
10. The at least one non-transitory machine-readable medium of claim 8 , wherein the online application is an in-browser web application, and wherein the in-browser web application is launched by a web application not hosted on a same platform as the cloud.
11. The at least one non-transitory machine-readable medium of claim 8 , wherein the first client encryption key and the second client encryption key are the same.
12. The at least one non-transitory machine-readable medium of claim 8 , wherein the first client encryption key and the second client encryption key are different.
13. A system for migrating a secure domain, the system comprising:
memory; and
at least one processor implemented in hardware configured to:
receive a notification that a client device is requesting to access original data associated with an in-browser web application, wherein the original data has been encrypted by a client-authorized device using a first client encryption key and is stored in encrypted format in a cloud;
decrypt, by the client-authorized device, the original data using the first client encryption key;
store the original data in decrypted format in the cloud;
enable access, by the client device and by the in-browser web application, to the original data in decrypted format while stored in the cloud;
determine, after the client device finishes accessing the original data in decrypted format, whether the original data in decrypted format was modified; and
delete, by the client-authorized device, based on a determination that the original data in decrypted format was not modified, the original data in decrypted format.
14. The system of claim 13 , wherein the at least one processor is further configured to:
encrypt, by the client-authorized device, based on a determination that the original data in decrypted format was modified, the modified data using a second client encryption key; and
upload the modified data in encrypted format to the cloud to replace the original data stored in the cloud.
15. The system of claim 14 , wherein the at least one processor is further configured to:
delete the original data in decrypted format.
16. The system of claim 14 , wherein the at least one processor is further configured to:
classify the modified data prior to encrypting using the second client encryption key.
17. The system of claim 13 , wherein the at least one processor is further configured to:
determine whether the cloud is trusted.