Granted Patent B2

US 12,470,380 · App. 17/957,515 · Granted Nov 11, 2025

Inventors: Jonathan Lee (Seattle, WA); Rajat Goel (San Jose, CA); Stas Ilinskiy (Seattle, WA); Wesley Rodriguez (San Francisco, CA); April King (Saint Paul, MN); Joseph Eichenhofer (San Francisco, CA)

Assignee: Dropbox, Inc.

H04L9/14H04L9/0877

Abstract

Claims (52)

1 . A method comprising:

receiving a request to access a plurality of blocks making up an object by a service of a content management system;

determining whether a user account requesting the plurality of blocks making up the object possesses a namespace encryption key, wherein an encrypted version of the namespace encryption key is stored at the content management system, the encrypted version of the namespace encryption key is encrypted using a top-level encryption key;

sending the encrypted version of the namespace encryption key to a key management service;

in response to sending the encrypted version of the namespace encryption key, receiving, by the service associated with the content management system, a decrypted version of the namespace encryption key from the key management service;

storing the decrypted version of the namespace encryption key in a namespace encryption key database at the content management system;

requesting, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;

receiving, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;

when the user account requesting the plurality of blocks making up the object also possesses access permissions for the object associated with the namespace encryption key, accessing the plurality of blocks making up the object from a storage system at the content management system and respective block encryption keys encrypting the plurality of blocks, wherein the respective block encryption keys are encrypted using the namespace encryption key;

decrypting the respective block encryption keys using the decrypted version of the namespace encryption key; and

decrypting the plurality of blocks using the respective block encryption keys.

2 . The method of claim 1 , wherein the plurality of blocks is made up of at least two blocks of no greater than 4 MB in size and each block of the at least two blocks making up the object is encrypted with a block encryption key that is unique to each block.

3 . The method of claim 1 , wherein the top-level encryption key is stored external to the content management system.

4 . The method of claim 1 , wherein the key management service utilizes a hardware security module to generate keys.

5 . The method of claim 1 , further comprising:

receiving a request to share a content item with a new namespace;

creating a copy of the namespace encryption key; and

providing the copy of the namespace encryption key to the new namespace.

6 . The method of claim 5 , further comprising:

creating a new namespace encryption key for the new namespace;

decrypting the respective block encryption keys using the copy of the namespace encryption key; and

encrypting a copy of each of the respective block encryption keys with the new namespace encryption key.

7 . A content management system comprising:

one or more processors; and

a non-transitory computer-readable medium storing instructions that, when executed by the one or more processors, cause the one or more processors to:

receive a request to access a plurality of blocks making up an object by a service of a content management system;

determine whether a user account requesting the plurality of blocks making up the object possesses a namespace encryption key, wherein an encrypted version of namespace encryption key is stored at the content management system, the encrypted version of the namespace encryption key is encrypted using a top-level encryption key;

send the encrypted version of the namespace encryption key to a key management service;

in response to sending the encrypted version of the namespace encryption key, receive, by the service associated with the content management system, a decrypted version of the namespace encryption key from the key management service;

store the decrypted version of the namespace encryption key in a namespace encryption key database at the content management system;

request, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;

receive, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;

when the user account requesting the plurality of blocks making up the object also possesses access permissions for the object associated with the namespace encryption key, access the plurality of blocks making up the object from a storage system at the content management system and respective block encryption keys encrypting the plurality of blocks, wherein the respective block encryption keys are encrypted using the namespace encryption key;

decrypt the respective block encryption keys using the decrypted version of the namespace encryption key; and

decrypt the plurality of blocks using the respective block encryption keys.

8 . The content management system of claim 7 , wherein the plurality of blocks is made up of at least two blocks of no greater than 4 MB in size and each block of the at least two blocks making up the object is encrypted with a block encryption key that is unique to each block.

9 . The content management system of claim 7 , wherein the top-level encryption key is stored external to the content management system.

10 . The content management system of claim 7 , wherein the key management service utilizes a hardware security module to generate keys.

11 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

receive a request to access a plurality of blocks making up an object by a service of a content management system;

determine whether a user account requesting the plurality of blocks making up the object possesses a namespace encryption key, wherein an encrypted version of namespace encryption key is stored at the content management system, the encrypted version of the names pace encryption key is encrypted using a top-level encryption key;

send the encrypted version of the namespace encryption key to a key management service;

in response to sending the encrypted version of the namespace encryption key, receive, by the service associated with the content management system, a decrypted version of the namespace encryption key from the key management service;

store the decrypted version of the namespace encryption key in a namespace encryption key database at the content management system;

request, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;

receive, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;

when the user account requesting the plurality of blocks making up the object is in possession of the namespace encryption key, access the plurality of blocks making up the object from a storage system at the content management system and respective block encryption keys encrypting the plurality of blocks, wherein the respective block encryption keys are encrypted using the namespace encryption key;

decrypt the respective block encryption keys using the namespace encryption key; and

decrypt the plurality of blocks using the respective block encryption keys.

12 . The non-transitory computer-readable medium of claim 11 , wherein the plurality of blocks is made up of at least two blocks of no greater than 4 MB in size and each block of the at least two blocks making up the object is encrypted with a block encryption key that is unique to each block.

13 . The non-transitory computer-readable medium of claim 11 , wherein the top-level encryption key is stored external to the content management system.

14 . The non-transitory computer-readable medium of claim 11 , wherein the key management service utilizes a hardware security module to generate keys.

Assignments (2)

Continuity (2)

References Cited (13)