Secure cloud-based shared content

Patent metadata

Field	Value
Publication number	US-10013431-B2
Application number	US-201615140330-A
Country	US
Kind code	B2
Filing date	Apr 27, 2016
Priority date	Apr 29, 2015
Publication date	Jul 3, 2018
Grant date	Jul 3, 2018

Abstract

Systems for managing content in a cloud-based service platform. Procedures for deduplication of a shared object in a cloud-based environment having one or more storage devices that store one or more files that are accessible by two or more entities. A computer-implemented method commences by generating a content-based encryption key for a shared object wherein the key is derived from one of the shared objects. The shared object is encrypted using the content-based encryption key to generate a content-based encrypted file. The content-based encrypted file is stored in a cloud-based storage system. A second or Nth entity and/or any number of users from the respective entities can upload the same file for shared storage, and before storing the same file for shared storage, a server in the cloud-based storage environment performs deduplication of the encrypted file across multiple entities by applying an intra-enterprise deduplicate directive or an inter-enterprise deduplicate directive.

First claim

What is claimed is:

1. A method for deduplication of a shared object in a cloud-based environment having with one or more storage devices that store one or more files that are accessible by two or more entities, the method comprising:
generating a content-based encryption key for a shared object, wherein the content-based encryption key is derived from the shared object;
encrypting the shared object using the content-based encryption key to generate a content-based encrypted file;
storing the content-based encrypted file at a cloud-based storage system at least once;
storing at least one of, a first enterprise key, the content-based encryption key, or a first enterprise-based encryption key, in object metadata, wherein the content-based encryption key is produced by decrypting the first enterprise-based encrypted key based at least in part on a first enterprise key corresponding to a first entity, wherein an unencrypted file is produced by decrypting the content-based encrypted file based at least in part on the content-based encryption key;
provisioning file access by at least a second entity to the shared object, the file access characterized at least in part by an association between a second enterprise key and the shared object, the second enterprise key for the second entity being different than the first enterprise key for the first entity;
encrypting, based at least in part on the second enterprise key, the content-based encryption key to produce a second enterprise-based encrypted key, the second enterprise-based encrypted key corresponding to the second entity being different than the first enterprise-based encrypted key corresponding to the first entity; and
performing deduplication of the content-based encrypted file across multiple entities that perform encryption, wherein the deduplication is performed based on at least one of, an intra-enterprise deduplicate directive, or an inter-enterprise deduplicate directive.

2. The method of claim 1 , further receiving a designation from an enterprise to two or more entities for access to sets of the files within the cloud-based environment wherein a first set of files are allocated to a first entity and wherein a second set of files are allocated to a second entity.

3. The method of claim 2 , further comprising receiving an encrypted subject file to be added to the first set of the files that are allocated to the first entity.

4. The method of claim 1 , further comprising:
determining at least one deduplication directive; and
storing, based at least in part on the deduplication directive, the content-based encrypted file.

5. The method of claim 4 , wherein at least one of, the intra-enterprise deduplicate directive, or the inter-enterprise deduplicate directive is accessed from metadata pertaining to a respective entity.

6. The method of claim 1 , wherein the content-based encryption key is a same content-based encryption key used by the first entity and the second entity to perform encryption on the shared object.

7. The method of claim 1 , further comprising:
receiving a collaboration invitation acceptance from at least one invitee from the multiple entities.

8. The method of claim 7 , further comprising storing the second enterprise-based encrypted key in object metadata.

9. The method of claim 1 , further comprising delivering, over a network, a virtual file system module to one or more user devices associated with the two or more entities to access one or more of the files, wherein the virtual file system module performs at least one act of the method.

10. A computer readable medium, embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by a processor causes the processor to perform a set of acts for deduplication of a shared object in a cloud-based environment having with one or more storage devices that store one or more files that are accessible by two or more entities, the acts comprising:
generating a content-based encryption key for a shared object, wherein the content-based encryption key is derived from the shared object;
encrypting the shared object using the content-based encryption key to generate a content-based encrypted file;
storing the content-based encrypted file at a cloud-based storage system at least once;
storing at least one of, a first enterprise key, the content-based encryption key, or a first enterprise-based encryption key, in object metadata, wherein the content-based encryption key is produced by decrypting the first enterprise-based encrypted key based at least in part on a first enterprise key corresponding to a first entity, wherein an unencrypted file is produced by decrypting the content-based encrypted file based at least in part on the content-based encryption key;
provisioning file access by at least a second entity to the shared object, the file access characterized at least in part by an association between a second enterprise key and the shared object, the second enterprise key for the second entity being different than the first enterprise key for the first entity;
encrypting, based at least in part on the second enterprise key, the content-based encryption key to produce a second enterprise-based encrypted key, the second enterprise-based encrypted key corresponding to the second entity being different than the first enterprise-based encrypted key corresponding to the first entity; and
performing deduplication of the content-based encrypted file across multiple entities that perform encryption, wherein the deduplication is performed based on at least one of, an intra-enterprise deduplicate directive, or an inter-enterprise deduplicate directive.

11. The computer readable medium of claim 10 , further receiving a designation from an enterprise to two or more entities for access to sets of the files within the cloud-based environment wherein a first set of files are allocated to a first entity and wherein a second set of files are allocated to a second entity.

12. The computer readable medium of claim 11 , further comprising instructions which, when stored in memory and executed by the processor causes the processor to perform acts of receiving an encrypted subject file to be added to the first set of the files that are allocated to the first entity.

13. The computer readable medium of claim 10 , further comprising instructions which, when stored in memory and executed by the processor causes the processor to perform acts of: determining at least one deduplication directive; and
storing, based at least in part on the deduplication directive, the content-based encrypted file.

14. The computer readable medium of claim 13 , wherein at least one of, the intra-enterprise deduplicate directive, or the inter-enterprise deduplicate directive is accessed from metadata pertaining to a respective entity.

15. The computer readable medium of claim 10 , wherein the content-based encryption key is a same content-based encryption key used by the first entity and the second entity to perform encryption on the shared object.

16. The computer readable medium of claim 10 , further comprising instructions which, when stored in memory and executed by the processor causes the processor to perform acts of: receiving a collaboration invitation acceptance from at least one invitee from the multiple entities.

17. A system for accessing a shared object in a cloud-based environment having one or more storage devices that store one or more files that are accessible

Assignees

• Box Inc

Inventors

• Luthra Tanooj
• Malhotra Ritik

Classifications

• G06F16/1727

  Details of free space management performed by the file system (saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F16/188

  Virtual file systems · CPC title

• G06F12/1081

  for peripheral access to main memory, e.g. direct memory access [DMA] · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title