210A-210Z generates a data encryption key and uses the data encryption key to encrypt the edit received. The client device 210A-210Z can generate the data encryption key according to the Advanced Encryption Standard (AES). The data encryption key can be at a length of, for example, 256 bits. The data encryption key can also be used to decrypt the encrypted edit. The client device 210A-210Z can generate the data encryption key based on any other encryption key standard at any other lengths.

Next, at operation 222, the client device 210A-210Z transmits the data encryption key to the key management server 215 for encryption or wrapping. In response, the key management server 215 can wrap or encrypt the data encryption key using a key encryption key and provide the encrypted data encryption key to the client device 210A-210Z. In some implementations, the key management server 215 can verify a document identifier (e.g., a name of the document) and/or user identifier (e.g., username@domain.com) associated with the client device 210A-210Z before performing the wrapping or encryption.

The key encryption key can be used for both encryption and decryption of the data encryption key. The key management server 215 can generate the key encryption key. The key management server 215 can generate the key encryption key, for example, according to the AES at a length of 256 bits. The key management server 215 can generate the key encryption key based on any other encryption key standard at any other lengths. At operation 224, the client device 210A-210Z receives the encrypted key from the key management server 215. In another implementation, the client device 210A-210Z can request the key management server 215 to provide the key encryption key and perform the wrapping or encryption of the data encryption key using the key encryption key by itself.

Then, at operation 226, the client device 210A-210Z provides encrypted data to the cloud server 212. That is, the client device 210A-210Z combines both the encrypted edit and encrypted key and transmits the combined data to the cloud server 212. In response, the cloud server 212 stores the encrypted data. The cloud server 212 also provides the encrypted data to an appropriate client device(s) 210A-210Z associated with other collaborator(s) of the document. In this way, the collaborator(s) of the document can have access to the same or substantially the same version of the document.

As such, the client device 210A-210Z prevents the cloud server 212 and the key management server 215 to access the edit (in a decrypted form) by ensuring that neither the cloud server 212 nor the key management server 215 is provided with both an encrypted edit and a corresponding data encryption key for decrypting the encrypted edit. That is, the client device 210A-210Z provides the encrypted edit and the encrypted key to the cloud server 212. Furthermore, the client device 210A-210Z provides only the corresponding data encryption key, but not the encrypted edit to the key management server 215. Nevertheless, collaborators would have access to the decrypted edit because a client device 210A-210Z of each collaborator will receive the encrypted edit from the cloud server 212 and obtain the corresponding data encryption key through the key management server 215, as will be described in details below with respect to FIG. 2B.

FIG. 2B illustrates an example of a system architecture 250 for providing secure collaborative editing of a document, in accordance with another implementation of the disclosure.

Similar to the system architecture 200 of FIG. 2A, the system architecture 250 includes client devices 260A-260Z, a cloud server 262, and a key management server 265. The client device 260A-260Z is connected with the cloud server 262 and the key management server 265, while the cloud server 262 and the key management server 265 are not connected to each other. The cloud server 262 corresponds to the server 112 of the FIG. 1. The key management server 265 also corresponds to the key management server 215 of FIG. 2A.

Similar to client devices 120A-120Z of FIG. 1 and similar to client devices 210A-210Z of FIG. 2A, a client device 260A-260Z enables a user to collaboratively edit a document in a secure online environment. That is, the user can securely share edits with other collaborators and securely receive edits made by other collaborators without exposing edits in a decrypted form to the cloud server 262 and the key management server 265, as will be described with respect to operations 270 to 276.

At operation 270, a client device 260A-260Z receives encrypted data from the cloud server 262. The encrypted data represents an edit to a portion of a document made by another collaborator of the document. The encrypted data includes the edit encrypted by a data encryption key and the data encryption key encrypted or wrapped by a key encryption key.

At operation 272, the client device 260A-260Z transmits the encrypted key from the encrypted data to the key management server 265. In response, the key management server 265 decrypts the encrypted key with the key encryption key and provides the decrypted key (i.e., the data encryption key) to the client device 260A-260Z. In some implementations, before the decryption, the key management server 265 can confirm a document identifier and/or user identifier associated with the client device 260A-260Z. At operation 274, the client device 260A-260Z receives the data encryption key from the key management server 265. In another implementation, the client device 260A-260Z can request the key management server 265 to provide the key encryption key and obtain the data encryption key by decrypting the encrypted key using the key encryption key.

At operation 276, the client device 260A-260Z performs decryption. For example, the client device 260A-260Z extracts the encrypted edit from the received encrypted data at operation 270. Then, the client device 260A-260Z decrypts the edit using the data encryption key obtained through the key management server 265. Accordingly, the client device 260A-260Z can access the edit made by another collaborator.

In further implementations, a client device 260A-260Z can be associated with a master or collaboration manager role for coordinating the online collaborative editing with the cloud server 262. Such a client device 260A-260Z can ensure that every collaborator has access to the same or substantially the same version of the document in coordination with the cloud server 262. For example, the cloud server 262 can route edits received from collaborators in an encrypted form to the client device 260A-260Z associated with the collaboration manager role. The client device 260A-260Z can then sort the edits, decrypted as described above, in a chronological order (after resolving any conflicts between the edits) and forward the ordered edits to other client devices 260A-260Z of the collaborators. In response, each of the client devices 260A-260Z of the collaborators can update a local version (or a document model) of the document based on the edits received. As such, the collaborators can view latest edits made by others and work on the same or substantially the same version of the document.

FIG. 3A depicts a flow diagram of a method 300 for generating encrypted data for secure online collaboration, in accordance with one implementation of the disclosure. The method 300 may be performed by a client-based application that runs in a web browser of a client device 120A-120Z, 210A-210Z, 260A-260Z, such as using HTML and JavaScript code. The client-based application may be executed by a processing device of the client devices 120A-120Z, 210A-210Z, 260A-260Z. The method 300 may be carried out for each client device 120A-120Z, 210A-210Z, 260A-260Z of the cloud-based content management platform 115. Further, the method 300 may be performed when a user of the client device 120A-120Z, 210A-210Z, 260A-260Z logs into a user account of a cloud storage system provided by the server 112, 212, 262. In another implementation, the method 300 may be performed by the secure collaboration component 116 of FIG. 1. Accordingly, the method 300 may be executed by one or more processing devices of the server 112, 212, 262.

For simplicity of explanation, the method 300 of this disclosure is depicted and described as a series of acts. However, acts in accordance with this disclosure can occur in various orders and/or concurrently, and with other acts not presented and described herein. Furthermore, not all illustrated acts may be required to implement the method 300 in accordance with the disclosed subject matter. In addition, those skilled in the art will understand and appreciate that the method 300 could alternatively be represented as a series of interrelated states via a state diagram or events. Additionally, it should be appreciated that the method 300 disclosed in this specification is capable of being stored on an article of manufacture to facilitate transporting and transferring such method to computing devices. The term “article of manufacture,” as used herein, is intended to encompass a computer program accessible from any computer-readable device or storage media.

At operation 302, the processing device of the client device 120A-120Z, 210A-210Z, 260A-260Z presents a graphical user interface (GUI) for online collaborative editing of a document. In one implementation, the GUI includes a portion of the latest version of the document and provides tools for the user to access (e.g., view or edit) the document and any other features needed for online collaboration with other users (i.e., collaborators). The processing device of the client device can obtain the latest version of the document by accessing a local version (or a document model) of the document associated with the user account. The local version of the document would reflect edits made by collaborators (including the user) since the creation of the document until the last time the user accessed the document. The local version is stored on the client device 120A-120Z, 210A-210Z, 260A-260Z and cannot be accessed by a server 112, 212, 262 of a cloud storage system (also referred to as cloud-based content management platform 110). Moreover, the local version can only be managed locally on the client device 120A-120Z, 210A-210Z, 260A-260Z (i.e., by the processing device of the client device) during the collaboration.

In order to obtain the latest version of the document, the client device 120A-120Z, 210A-210Z, 260A-260Z can send a request to the server 112, 212, 262 for any edits received from other collaborators since the last access by the user. For example, the processing device can provide the server 112, 212, 262 with log-in credentials (e.g., a user identifier such as ‘username@domain.com’ and a password) of the user account of the cloud storage system. After the successful log-in, the server 112, 212, 262 can provide to the client device 120A-120Z, 210A-210Z, 260A-260Z (e.g., via a UI representing a home screen of the user account) a list of documents (e.g., word documents, spreadsheet documents, presentation slides) stored by the server 112, 212, 262 for the user account.

The server 112, 212, 262 can store the documents in an encrypted form but has no access to a decrypted form of the documents. Each document stored on the server 112, 212, 262 can correspond to a group of encrypted data received from client devices 120A-120Z, 210A-210Z, 260A-260Z associated with collaborators of the document. The group of encrypted data represents all edits made to the document since the document has been created. Accordingly, the server 112, 212, 262 stores the entire content of the document in an encrypted form. Further details of the encrypted data will be described below.

The client device 120A-120Z, 210A-210Z, 260A-260Z can receive a selection of a document listed on the home screen from the user via the web browser and indicate the selection to the server 112, 212, 262 along with the time when the user last logged out of the cloud storage system. In response, the server 112, 212, 262 can provide any edits received from other collaborators in an encrypted form to the client device 120A-120Z, 210A-210Z, 260A-260Z. The client device 120A-120Z, 210A-210Z, 260A-260Z can decrypt the received data in a similar manner as will be described with respect to FIG. 3B. Then, the client device 120A-120Z, 210A-210Z, 260A-260Z can incorporate the edits made by other collaborators into the local version, thereby updating the local version to correspond to be the latest version of the document.

At operation 304, the client device 120A-120Z, 210A-210Z, 260A-260Z receives an edit to a portion of the document via the GUI. Examples of the edit or mutation can include a keystroke(s) in a portion (at a particular index or location) of the document and an icon or menu selection changing a format of text in a portion of the document. The client device 120A-120Z, 210A-210Z, 260A-260Z can receive the edit via the GUI from the user of the client device 120A-120Z, 210A-210Z, 260A-260Z. The client device 120A-120Z, 210A-210Z, 260A-260Z can receive the keystroke(s) and/or an icon or menu selection(s) performed over a period of time (e.g., 0.5 second) and identify the series of input as an edit. In another example, the client device 120A-120Z, 210A-210Z, 260A-260Z can receive, as an edit, each keystroke or an icon or menu selection. Additionally, the client device 120A-120Z, 210A-210Z, 260A-260Z can update the document on the GUI to reflect the received edit. For example, the client device 120A-120Z, 210A-210Z, 260A-260Z can incorporate the received edit to the local version of the document and present the updated version on the GUI.

In further implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can log the received edit at operation 304. For example, the client device 120A-120Z, 210A-210Z, 260A-260Z can record a log entry comprising the edit (e.g., a keystroke(s) in a portion of the document, an icon or a menu selection for text in a portion of the document), a timestamp representing the time when the edit was received, a user identifier, and/or a document identifier (e.g., a name of the document). The log entry can later be used to resolve any conflicts in updating the local version of the document as will be described with respect to FIG. 4.

The log entries can be also used to sort edits made by collaborators of the document, in case the user account associated with the client device 120A-120Z, 210A-210Z, 260A-260Z is assigned a master or collaboration manager role in the online collaborative editing of the document. Such a role necessitates the client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager user account to manage the online collaborative editing using the log by ensuring that every collaborator has access to the same or substantially the same version of the document. The client device 120A-120Z, 210A-210Z, 260A-260Z receives edits made by collaborators from the server 112, 212, 262 and logs every edit as described above. The client device 120A-120Z, 210A-210Z, 260A-260Z sorts the edits in a chronological order based on the log entries (after resolving any conflicts). Further, the client device 120A-120Z, 210A-210Z, 260A-260Z distributes the ordered edits to client devices 120A-120Z, 210A-210Z, 260A-260Z of other collaborators so that each local version of the client devices 120A-120Z, 210A-210Z, 260A-260Z is updated in the same way. Further details of the master or collaboration role will be described with respect to FIGS. 3B and 4 below.

At operation 306, the client device 120A-120Z, 210A-210Z, 260A-260Z generates encrypted data representing the edit. In some implementations, the encrypted data can include the edit encrypted based on a data encryption key using symmetric encryption. That is, the client device 120A-120Z, 210A-210Z, 260A-260Z can generate the data encryption key and encrypt the edit using the data encryption key. The symmetric encryption requires only one data encryption key to encrypt and decrypt data. The client device can generate a data encryption key according to the Advanced Encryption Standard (AES). The data encryption key can be at a length of, for example, 256 bits. The client device 120A-120Z, 210A-210Z, 260A-260Z can generate the data encryption key based on any other encryption standard and at any other lengths. The client device 120A-120Z, 210A-210Z, 260A-260Z can generate different data encryption keys each time the client device 120A-120Z, 210A-210Z, 260A-260Z encrypts an edit.

In addition to the encrypted edit, the encrypted data can also include an encrypted key—the data encryption key encrypted or wrapped based on a key encryption key. For example, the client device 120A-120Z, 210A-210Z, 260A-260Z can request a key management server 215, 265 to encrypt or wrap the data encryption key. The key management server 215, 265 is a server that manages encryption and decryption of a data encryption key. The key management server 215, 265 can first authorize the request based on a user identifier and/or document identifier received from the processing device before processing a request encryption and decryption. The key management server 215, 265 can generate a key encryption key that is used for both encryption and decryption of a data encryption key. The key management server 215, 265 can generate the key encryption key according to the AES at a length of 256 bits. The key management server 215, 265 can generate the key encryption key based on any other encryption standards at any other lengths. The key management server 215, 265 can use the same key encryption key for encrypting any data encryption keys associated with the same document or the same group of collaborators. Depending on the request, the key management server 215, 265 can merely provide the key encryption key to the client device 120A-120Z, 210A-210Z, 260A-260Z or can perform the encryption and decryption of a data encryption key. In one implementation, the key management server 215, 265 is only connected to the client device 120A-120Z, 210A-210Z, 260A-260Z and not to the server 112, 212, 262 of the cloud storage system.

In generating the encrypted key, the client device 120A-120Z, 210A-210Z, 260A-260Z can send the data encryption key and a request to encrypt or wrap the data encryption key to the key management server 215, 265. In the request, the client device 120A-120Z, 210A-210Z, 260A-260Z can include identifying information such as a document identifier or a user identifier for authorization by the key management server 215, 265. Subsequently, the client device 120A-120Z, 210A-210Z, 260A-260Z can receive from the key management server 215, 265 the encrypted key. In some other implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can request a key encryption key from the key management server 215, 265, without requesting the encryption or wrapping to be performed by the key management server 215, 265. In such a case, the client device 120A-120Z, 210A-210Z, 260A-260Z receives the key encryption key from the key management server 215, 265 and locally encrypt the data encryption key using the key encryption key. Furthermore, the client device 120A-120Z, 210A-210Z, 260A-260Z can use the same key encryption key to encrypt any data encryption keys the client device 120A-120Z, 210A-210Z, 260A-260Z generates for encryption of edits associated with the same document.

Because the client device 120A-120Z, 210A-210Z, 260A-260Z only provides the encryption request (and the data encryption key), the key management sever does not have access to any portion of the document either in an encrypted form or decrypted form. Once the client device 120A-120Z, 210A-210Z, 260A-260Z has the encrypted edit and the encrypted key, the client device 120A-120Z, 210A-210Z, 260A-260Z can combine the encrypted edit and the encrypted key to generate the encrypted data.

At operation 308, the client device 120A-120Z, 210A-210Z, 260A-260Z provides the encrypted data to the server 112, 212, 262 of the cloud-based storage system. In some implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can attach the encrypted key to the encrypted edit and provide a single data packet of the encrypted data to the server 112, 212, 262. In some other implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can provide the encrypted key and the encrypted edit as separate data packets to the server 112, 212, 262. Furthermore, the client device 120A-120Z, 210A-210Z, 260A-260Z can also provide identifying information (e.g., a document identifier and/or user identifier) and a timestamp (indicating the time when the edit was received) associated with the encrypted data to the server 112, 212, 262. The server 112, 212, 262 can use such identifying information and the timestamp in storing the encrypted data and in determining to which client device 120A-120Z, 210A-210Z, 260A-260Z the encrypted data should be transmitted. Further details about operations of the server 112, 212, 262 will be described with respect to FIG. 4 below. In case the client device 120A-120Z, 210A-210Z, 260A-260Z is associated with the master or collaboration manager user account, the client device 120A-120Z, 210A-210Z, 260A-260Z can skip operations 306 and 308 because the client device 120A-120Z, 210A-210Z, 260A-260Z should wait until a certain condition is satisfied before performing operations 306 and 308 as will be described below with respect to FIG. 3B.

FIG. 3B illustrates a flow diagram of a method 350 for updating an online collaborative document based on encrypted data, in accordance with one implementation of the disclosure. The method 350 may be performed by a client-based application that runs in a web browser of a client device 120A-120Z, 210A-210Z, 260A-260Z, such as using HTML and JavaScript code. The client-based application may be executed by a processing device of the client devices 120A-120Z, 210A-210Z, 260A-260Z. The method 350 may be carried out for each client device 120A-120Z, 210A-210Z, 260A-260Z of the cloud-based content management platform 115. Further, the method 350 may be performed when a user of the client device 120A-120Z, 210A-210Z, 260A-260Z logs into a user account of a cloud storage system provided by the server 112, 212, 262. In another implementation, the method 350 may be performed by the secure collaboration component 116 of FIG. 1. Accordingly, the method 350 may be executed by one or more processing devices of the server 112, 212, 262.

For simplicity of explanation, the method 350 of this disclosure is depicted and described as a series of acts. However, acts in accordance with this disclosure can occur in various orders and/or concurrently, and with other acts not presented and described herein. Furthermore, not all illustrated acts may be required to implement the method 350 in accordance with the disclosed subject matter. In addition, those skilled in the art will understand and appreciate that the method 350 could alternatively be represented as a series of interrelated states via a state diagram or events. Additionally, it should be appreciated that the method 350 disclosed in this specification are capable of being stored on an article of manufacture (e.g., a computer program accessible from any computer-readable device or storage media) to facilitate transporting and transferring such method to computing devices.

At operation 352, the client device 120A-120Z, 210A-210Z, 260A-260Z presents a graphical user interface (GUI) for online collaborative editing of a document. The client device 120A-120Z, 210A-210Z, 260A-260Z can provide the GUI in a similar manner as described with respect to operation 302 of FIG. 3A. The client device 120A-120Z, 210A-210Z, 260A-260Z can present, via the web browser, the GUI that enables the user to edit the document.

At operation 354, the client device 120A-120Z, 210A-210Z, 260A-260Z receives encrypted data associated with the document from the server 112, 212, 262 of the cloud-based storage system. In one implementation, the encrypted data has been generated by another client device 120A-120Z, 210A-210Z, 260A-260Z in a similar manner described with respect to operation 306 of FIG. 3A above. Accordingly, the encrypted data represents an edit to a portion of the document. The encrypted data includes an edit that has been encrypted using a data encryption key. The edit, such as a keystroke(s) and/or an icon or menu selection has been made by collaborator(s) of the document. The encrypted data also includes an encrypted key—the data encryption key encrypted or wrapped based on a key encryption key. The client device 120A-120Z, 210A-210Z, 260A-260Z can further receive a timestamp associated with the encrypted data. The timestamp can represent the time when the edit was made or the time the server 112, 212, 262 received the encrypted data from another client device 120A-120Z, 210A-210Z, 260A-260Z.

At operation 356, the client device 120A-120Z, 210A-210Z, 260A-260Z decrypts the encrypted data. If the client device 120A-120Z, 210A-210Z, 260A-260Z has the key encryption key (as previously received from a key management server 215, 265), then the client device 120A-120Z, 210A-210Z, 260A-260Z can decrypt the encrypted key using the key encryption key. Then, the client device 120A-120Z, 210A-210Z, 260A-260Z can decrypt the encrypted edit based on the decrypted key.

In case the client device 120A-120Z, 210A-210Z, 260A-260Z does not already have the key encryption key, the client device 120A-120Z, 210A-210Z, 260A-260Z can request the key management server 215, 265 for decryption of the encrypted key included in the encrypted data. Similar to the key management server 215, 265 of the FIG. 3A, the key management server 215, 265 manages encryption and decryption of a data encryption key and is only connected to the client device 120A-120Z, 210A-210Z, 260A-260Z and not to the server 112, 212, 262 of the cloud storage system. In some implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can provide the encrypted key to the key management server 215, 265 as a part of the request for decryption. The client device 120A-120Z, 210A-210Z, 260A-260Z can also transmit identifying information such as a document identifier and/or user identifier for authorization by the key management server 215, 265. After the authorization, the key management server 215, 265 can retrieve a key encryption key corresponding to the received encrypted key based on the identifying information.

Then, the key management server 215, 265 can decrypt the received encrypted key using the key encryption key and provide the decrypted key to the client device 120A-120Z, 210A-210Z, 260A-260Z. In some other implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can request the key management server 215, 265 to provide the key encryption key for the encrypted key based on the identifying information. The key management server 215, 265 can retrieve the key encryption key based on the identifying information and transmit the key encryption key to the client device 120A-120Z, 210A-210Z, 260A-260Z. In response, the client device 120A-120Z, 210A-210Z, 260A-260Z can decrypt the encrypted key using the received key encryption key. Once the client device 120A-120Z, 210A-210Z, 260A-260Z has the key encryption key, the client device 120A-120Z, 210A-210Z, 260A-260Z can re-use the same key encryption key to decrypt any encrypted keys associated with the same document. In response to obtaining the decrypted key (i.e., the data encryption key), the client device 120A-120Z, 210A-210Z, 260A-260Z can decrypt the encrypted edit that was included in the encrypted data using the data encryption key.

In further implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can log the decrypted edit at operation 356 in a similar manner described with respect to FIG. 3A above, in case the client device 120A-120Z, 210A-210Z, 260A-260Z is associated with the master or collaboration manager user account. For example, the client device 120A-120Z, 210A-210Z, 260A-260Z can record a log entry comprising the edit (e.g., a keystroke(s) in a portion of the document, an icon or a menu selection for text in a portion of the document), a timestamp representing the time when the edit was received, a user identifier, and/or a document identifier (e.g., a name of the document)).

Moreover, the client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager user account can determine whether or not to consolidate or combine edits received so far. The client device 120A-120Z, 210A-210Z, 260A-260Z can base the determination on a period of time passed since the last consolidation which can be identified from the log. That is, the client device 120A-120Z, 210A-210Z, 260A-260Z can consolidate edits on a periodic basis. In other implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can base the determination on a number of edits received since the last consolidation (i.e., the client device 120A-120Z, 210A-210Z, 260A-260Z can wait until a particular number of edits are received before the consolidation).

Once the client device 120A-120Z, 210A-210Z, 260A-260Z determines to consolidate edits made to the document by collaborators, the client device 120A-120Z, 210A-210Z, 260A-260Z can sort edits in a chronological order using timestamps of log entries. The client device 120A-120Z, 210A-210Z, 260A-260Z can combine the sorted edits into a single edit. For example, a first edit can be an insertion of a sentence and a second edit can be an insertion of a word in the middle of the sentence. Then, the client device 120A-120Z, 210A-210Z, 260A-260Z can combine the two edits into a single edit having an insertion of the sentence updated with the inserted word. In some implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can prepare the consolidated edit specific to each collaborator. In such a case, the client device 120A-120Z, 210A-210Z, 260A-260Z can maintain separate logs for each collaborator. In some other implementations, the client device 120A-120Z, 210A-210Z, 260A-260Z can generate the consolidated edit for all collaborators.

In case there are overlapping or conflicting edits having the same or substantially the same timestamp (e.g., within a second), the client device 120A-120Z, 210A-210Z, 260A-260Z can resolve any conflicts using a set of rules. Examples of overlapping or conflicting edits include one edit for inserting a word in a sentence and another edit for deleting the sentence. In such a case, the client device 120A-120Z, 210A-210Z, 260A-260Z can apply a rule (e.g., the deletion is given the priority over insertion) to remove the sentence from the document.

Once the client device 120A-120Z, 210A-210Z, 260A-260Z has generated the consolidated edit, the client device 120A-120Z, 210A-210Z, 260A-260Z can encrypt the consolidated edit in a similar manner as described above with respect to FIG. 3A. That is, the client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager user account generates a data encryption key and encrypts the consolidated edit with the data encryption key. The client device 120A-120Z, 210A-210Z, 260A-260Z can then request the key management server 215, 265 for encryption or wrapping of the data encryption key. Once the client device 120A-120Z, 210A-210Z, 260A-260Z obtains the encrypted edit and the encrypted key, the client device 120A-120Z, 210A-210Z, 260A-260Z can provide the encrypted data to the server 112, 212, 262 of the cloud storage system. In case the client device 120A-120Z, 210A-210Z, 260A-260Z has generated the consolidated edit specific to a collaborator, the client device 120A-120Z, 210A-210Z, 260A-260Z can also provide a user identifier of the collaborator for a target destination address so that the server 112, 212, 262 can determine to which collaborator the encrypted data is to be provided.

At operation 358, the client device 120A-120Z, 210A-210Z, 260A-260Z updates the document provided on the GUI based on the decrypted data. For example, the client device 120A-120Z, 210A-210Z, 260A-260Z can apply the decrypted edit to the local version of the document maintained by the client device 120A-120Z, 210A-210Z, 260A-260Z so that the local version can be updated to the latest version. The edit can be the consolidated edit generated by the client device 120A-120Z, 210A-210Z, 260A-260Z of the collaboration manager reflecting edits made by collaborators of the document. In case the client device 120A-120Z, 210A-210Z, 260A-260Z is associated with the master or collaboration manager user account, the edit would be made by one other collaborator.

In one implementation, when applying the decrypted edit to the local version of the document, the client device 120A-120Z, 210A-210Z, 260A-260Z can identify conflicting or overlapping edits between an edit already made by the user of the client device 120A-120Z, 210A-210Z, 260A-260Z and the decrypted edit. For example, the user of the client device 120A-120Z, 210A-210Z, 260A-260Z could have added a word to a sentence (i.e., a local edit) in the version of the document, but the decrypted edit could be a deletion of the sentence at the same or substantially the same time. The client device 120A-120Z, 210A-210Z, 260A-260Z can determine the timing of the local edit from log entries that includes edits made to the local version by the user and the timing of the decrypted edit from the timestamp received in association with the encrypted data at operation 354. The client device 120A-120Z, 210A-210Z, 260A-260Z can resolve the conflict using a set of rules. The client device 120A-120Z, 210A-210Z, 260A-260Z can, for example, apply a rule that gives a priority to a deletion over an insertion. As a result, when updating the version of the document, the client device 120A-120Z, 210A-210Z, 260A-260Z can undo or remove already applied edit and instead apply the decrypted edit.

FIG. 4 depicts a flow diagram of a method 400 for providing encrypted data to collaborators, in accordance with one implementation of the disclosure. The method 400 may be performed by the secure collaboration component 116 of FIG. 1. The method 400 may be executed by one or more processing devices of the server 112, 212, 262. The method 400 may be carried out for each client device 120A-120Z, 210A-210Z, 260A-260Z of the cloud-based content management platform 115.

For simplicity of explanation, the method 400 of this disclosure is depicted and described as a series of acts. However, acts in accordance with this disclosure can occur in various orders and/or concurrently, and with other acts not presented and described herein. Furthermore, not all illustrated acts may be required to implement the method 400 in accordance with the disclosed subject matter. In addition, those skilled in the art will understand and appreciate that the method 400 could alternatively be represented as a series of interrelated states via a state diagram or events. Additionally, it should be appreciated that the method 400 disclosed in this specification are capable of being stored on an article of manufacture (e.g., a computer program accessible from any computer-readable device or storage media) to facilitate transporting and transferring such method to computing devices.

At operation 402, a cloud storage system (i.e., the processing device of the cloud storage system) receives encrypted data from a client device 120A-120Z, 210A-210Z, 260A-260Z. The encrypted data represents an edit to a portion of a document. Examples of the edit or mutation can include a keystroke(s) in a portion (at a particular index or location) of the document and an icon or menu selection changing a format of text in a portion of the document. The encrypted data can include an encrypted edit and encrypted key. The encrypted edit corresponds to the edit encrypted using a data encryption key. The encrypted key corresponds to the data encryption key encrypted or wrapped using a key encryption key. Because the data encryption key is encrypted using the key encryption key and the processing device does not have access to the key encryption key, the processing device cannot decrypt the (encrypted) edit. Consequently, the cloud storage system cannot access any portion of the document in a decrypted form.

The cloud storage system can also receive identifying information of the encrypted data such as a user identifier (e.g., username@domain.com) associated with the client device 120A-120Z, 210A-210Z, 260A-260Z and a document identifier (e.g., a name of the document) of the document associated with the edit. In some implementations, the cloud storage system can receive a timestamp indicating when the edit was received at the client device 120A-120Z, 210A-210Z, 260A-260Z. In case the cloud storage system does not receive the time stamp, the cloud storage system can generate a timestamp indicating when the encrypted data was received. The cloud storage system can use such identifying information and the timestamp in storing the encrypted data and in determining to which client device 120A-120Z, 210A-210Z, 260A-260Z the encrypted data should be transmitted.

In response to receiving the encrypted data, the cloud storage system can store the encrypted data in association with the identifying information and/or the timestamp in a data store of the cloud-based storage system. Based on the timestamps, the cloud storage system can store the encrypted data in a chronological order for the encrypted data having the same document identifier. Accordingly, the cloud storage system can store all edits made to a document since the document has been created in an encrypted form. Such edits would effectively represent the respective document. As such, the cloud-based storage system stores a plurality of documents in an encrypted form.

At operation 404, the cloud storage system determines a document associated with the encrypted data. In one implementation, the cloud storage system can identify which document is associated with the encrypted data based on the identifying information (i.e., a document identifier) received from the client device 120A-120Z, 210A-210Z, 260A-260Z. In case the cloud storage system has not received the document identifier, the cloud storage system can request the client device 120A-120Z, 210A-210Z, 260A-260Z for the identifying information.

At operation 406, the cloud storage system determines user accounts of collaborators of the document. In one implementation, the cloud storage system can determine user identifiers representing user accounts and that are associated with the document identifier of the determined document from a data store. The data store can store a table listing document identifiers with associated user identifiers. The data store can be included in the cloud storage system. For each document identifier in the data store, user accounts that have access (e.g., view or edit) to a document associated with the respective document identifier can be recorded. Thus, a user account associated with the client device 120A-120Z, 210A-210Z, 260A-260Z should be included in the determined user accounts (because the edit represented by the encrypted data received at operation 402 was made by a user of the user account associated with the client device 120A-120Z, 210A-210Z, 260A-260Z).

In further implementations, the cloud storage system can determine a user account having a master or collaboration manager role assigned. The collaboration manager role is for coordinating the online collaborative editing with the cloud storage system by ensuring that ensures every collaborator has access to the same or substantially the same version of the document. In the data store, for each user identifier associated with a document identifier, it can be recorded whether or not the respective user identifier is assigned a master or collaboration manager role in online collaborative editing of a document associated with the corresponding document identifier. Thus, the cloud storage system can determine from the data store the collaboration manager role user account based on the document identifier.

The respective user may not be aware of this role because all processes related to the assignment of this role can be carried out in the background by the cloud storage system and the server 112, 212, 262. The cloud storage system can coordinate with a client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager role to ensure that collaborators have access to the same or substantially the same version of the document. For example, when the cloud storage system receives encrypted data from a client device 120A-120Z, 210A-210Z, 260A-260Z not associated with the collaboration manager role, the cloud storage system can route the encrypted data to a client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager role. The client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager role can consolidate edits (after decrypting the encrypted data) made by collaborators into encrypted data that is sent to the cloud storage system. The cloud storage system then distributes the encrypted data received from the client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager role to the other collaborators.

In some embodiments, there should be only one user identifier assigned to that role by the cloud storage system. Initially, the cloud storage system can configure a user account of a user who created a document to perform the collaboration manager role. The cloud storage system can designate the collaboration manager role to the user account and record as such in the data store. The cloud storage system can change the role assignment under certain circumstances.

For example, when the cloud storage system detects that a user having the collaboration manager user account of the current document logs out of the cloud storage system, the cloud storage system can reassign the role to another collaborator. In another example, when the cloud storage system detects a response time of a client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager user account satisfies a predetermined threshold condition (e.g., the client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager has not provided a response for more than 2 seconds), the cloud storage system can reassign the role to another collaborator. An example of the response time can include a time period since the cloud storage system has provided an encrypted data to the client device 120A-120Z, 210A-210Z, 260A-260Z of the collaboration manger until the cloud storage system has received another encrypted data from the client device 120A-120Z, 210A-210Z, 260A-260Z of the collaboration manger. In addition or in the alternative, the response time can be any period of time the client device 120A-120Z, 210A-210Z, 260A-260Z of the collaboration manger took to respond to communication from the cloud storage system. The cloud storage system can reassign the role to any other collaborators who is currently logged into the cloud storage system.

At operation 408, the cloud storage system provides the encrypted data to other client device(s) 120A-120Z, 210A-210Z, 260A-260Z that are each associated with respective user accounts, excluding the user account associated with the client device 120A-120Z, 210A-210Z, 260A-260Z. That is, the cloud storage system does not send the encrypted data back to the sender. In one implementation, the cloud storage system can determine whether the client device 120A-120Z, 210A-210Z, 260A-260Z that sent the encrypted data is assigned the collaboration manager role. If the client device 120A-120Z, 210A-210Z, 260A-260Z is associated with the collaboration manager user account, then the encrypted data represents an edit to a portion of the document that was made by collaborators of the document. Thus, such encrypted data should be distributed to collaborators other than the collaboration manager. On the other hand, if the client device 120A-120Z, 210A-210Z, 260A-260Z is not associated with the collaboration manager role, then the encrypted data represents an edit to a portion of the document made by a respective user of the client device 120A-120Z, 210A-210Z, 260A-260Z. Accordingly, the encrypted data can be routed to the client device 120A-120Z, 210A-210Z, 260A-260Z associated with the collaboration manager role so that the client device 120A-120Z, 210A-210Z, 260A-260Z can consolidate edits from various collaborators.

The cloud storage system can determine from the data stored in the data store whether the client device 120A-120Z, 210A-210Z, 260A-260Z is associated with the collaboration manager role based on a user identifier of the client device 120A-120Z, 210A-210Z, 260A-260Z. The cloud storage system can receive the user identifier in association with the encrypted data at operation 402. In case the cloud storage system has not received the user identifier, the cloud storage system can request the client device 120A-120Z, 210A-210Z, 260A-260Z to provide the user identifier.

In case the cloud storage system determines that the client device 120A-120Z, 210A-210Z, 260A-260Z is associated with the collaboration manager role, the cloud storage system can determine collaborators other than the collaboration manager from the user accounts of collaborators of the document determined at operation 406. Then, the cloud storage system can transmit the encrypted data to client devices 120A-120Z, 210A-210Z, 260A-260Z associated with the other collaborators of the document. Accordingly, the cloud storage system can route the consolidated edit from the collaboration manager to other collaborators so that every collaborator can see all the changes made to the document and access the same or substantially the same version of the document.