Abstract:
Techniques are presented herein for receiving a hash value of a file computed by a collaboration client prior to the collaboration client uploading the file to a collaboration server in an attempt to share the file with another collaboration client. The collaboration server may query an internal file storage system of file hashes for a hash value of a previously uploaded file that matches the hash value of the file to be uploaded. In response to the collaboration server receiving a notification that a matching hash value was not found in the file storage system, the collaboration server queries a first connector service that is in communication with a first service that has access to at least a first file storage system that is external to the collaboration server. The collaboration server queries the first connector service with the hash value of the file to be uploaded.
Abstract:
An end-to-end secure cloud-hosted collaboration service is provided with a hybrid cloud/on-premise index and search capability. This approach includes on-premise indexing and search handling, while relying on the cloud for persistent storage and search of the index. The on-premise indexer receives a copy of an encrypted message from the cloud-hosted collaboration service. The encrypted message has been encrypted with a conversation key. The indexer receives the conversation key from an on-premise key management service, and decrypts the encrypted message with the conversation key. A set of tokens are extracted from the decrypted message, and subsequently encrypted with a secret key, different than the conversation key, to generate a first set of encrypted tokens. The first set of encrypted tokens is transmitted for storage in a search index on the cloud-hosted collaboration service.
Abstract:
An end-to-end secure cloud-hosted collaboration service is provided with a hybrid cloud/on-premise index and search capability. This approach includes on-premise indexing and search handling, while relying on the cloud for persistent storage and search of the index. The on-premise indexer receives a copy of an encrypted message from the cloud-hosted collaboration service. The encrypted message has been encrypted with a conversation key. The indexer receives the conversation key from an on-premise key management service, and decrypts the encrypted message with the conversation key. A set of tokens are extracted from the decrypted message, and subsequently encrypted with a secret key, different than the conversation key, to generate a first set of encrypted tokens. The first set of encrypted tokens is transmitted for storage in a search index on the cloud-hosted collaboration service.
Abstract:
The embodiments presented herein provide for a method for a key management service (KMS) to provide a conversation key over individually established secure channels. The KMS establishes, with a first device, a first ephemerally secure communication channel over an unsecure network. The KMS receives, over the first ephemerally secure communication channel, a first request for a conversation key. After obtaining the conversation key, the KMS transmits the conversation key to the first device over the first ephemerally secure communication channel. The KMS establishes, with a second device, a second ephemerally secure communication channel over the unsecure network. The KMS receives, over the second ephemerally secure communication channel, a second request for the conversation key. The conversation key is transmitted to the second device over the second ephemerally secure communication channel.
Abstract:
Techniques are provided for augmenting the capabilities of the standard OAuth2 authorization framework in such a way as to allow clients to consume the services of multiple resource servers residing in disjoint security domains while requiring only a single one-time user authentication. An access token that provides access to resource services distributed across a plurality of security domains is partitioned into a plurality of reduced-scope access tokens. Each reduced-scope access token is limited to a subset of authorization scopes of the access token, providing access to a resource service in a particular security domain based upon the subset.
Abstract:
A system and method for achieving authorization in confidential group communications in terms of an ordered list of data blocks representing a tamper-resistant chronological account of group membership updates. This method permits ad-hoc and decentralized group definition, dynamic and decentralized membership updates, open sharing, tamper resistance, and tracking of membership history. There are many applications of these techniques. One such application is enabling end-to-end encryption of instant messaging, content sharing, and streamed media.
Abstract:
Techniques are presented herein for receiving a hash value of a file computed by a collaboration client prior to the collaboration client uploading the file to a collaboration server in an attempt to share the file with another collaboration client. The collaboration server may query an internal file storage system of file hashes for a hash value of a previously uploaded file that matches the hash value of the file to be uploaded. In response to the collaboration server receiving a notification that a matching hash value was not found in the file storage system, the collaboration server queries a first connector service that is in communication with a first service that has access to at least a first file storage system that is external to the collaboration server. The collaboration server queries the first connector service with the hash value of the file to be uploaded.
Abstract:
A system and method for achieving authorization in confidential group communications in terms of an ordered list of data blocks representing a tamper-resistant chronological account of group membership updates. This method permits ad-hoc and decentralized group definition, dynamic and decentralized membership updates, open sharing, tamper resistance, and tracking of membership history. There are many applications of these techniques. One such application is enabling end-to-end encryption of instant messaging, content sharing, and streamed media.
Abstract:
A system and method for achieving authorization in confidential group communications in terms of an ordered list of data blocks representing a tamper-resistant chronological account of group membership updates. This method permits ad-hoc and decentralized group definition, dynamic and decentralized membership updates, open sharing, tamper resistance, and tracking of membership history. There are many applications of these techniques. One such application is enabling end-to-end encryption of instant messaging, content sharing, and streamed media.
Abstract:
An end-to-end secure cloud-hosted collaboration service is provided with a hybrid cloud/on-premise index and search capability. This approach includes on-premise indexing and search handling, while relying on the cloud for persistent storage and search of the index. The on-premise indexer receives a copy of an encrypted message from the cloud-hosted collaboration service. The encrypted message has been encrypted with a conversation key. The indexer receives the conversation key from an on-premise key management service, and decrypts the encrypted message with the conversation key. A set of tokens are extracted from the decrypted message, and subsequently encrypted with a secret key, different than the conversation key, to generate a first set of encrypted tokens. The first set of encrypted tokens is transmitted for storage in a search index on the cloud-hosted collaboration service.