BACKGROUND

The resources required to manage a system storing secret data can present challenges for companies of all sizes. If not administered correctly, human error or improperly managed maintenance tasks can cause security issues. Administrative costs and the exposure to various forms of risk can increase significantly when data centers provide services for large user groups. Security risks can be increased further when such systems have a high user attrition rate.

Additional challenges may arise when a third-party entity is used to store secret data. For instance, a particular company may use a third-party service to store secret data. Although such services may provide higher levels of security with respect to certain types of threats versus self-managed turnkey systems, there may be a number of drawbacks for companies that wish to maintain a high level of security against malicious users or even the administrators of the third-party service.

It is with respect to these and other considerations that the disclosure made herein is presented.

SUMMARY

The techniques disclosed herein provide improved security for secret data shared between members of a group. Users can share secret data while they are members of a collaborative group activity, such as, but not limited to, a channel, chat session, meeting, or a communication session. A system storing the secret data can utilize an individual vault key that is associated with a particular group of users. When users join or leave a group, as they might with a channel or a chat session, the system can utilize the individual vault key to control access to the secret data shared by the group. In some configurations, individual vaults key can be associated with individual group of users. For instance, a system may provide a vault key for each channel that is created within applications such as MS Teams or Slack. The vault key can be used in a sequence of encryption steps that involve encrypting secret data using a security key, encrypting the security key using a vault key, and encrypting the vault key using a public key associated with a user. The system can store the encrypted data in a vault and grant access to those who are part of a group. Participation of a group can be verified by the use of a verification request to a group management system, such as MS Teams or Slack. By the use of the vault key and by leveraging the benefits of a group management system, a storage system can mitigate the administrative overhead required to manage a system that has dynamic user groups having a high attrition rate of users. The system can also improve security by only storing the encrypted data, which is generated on remote client computers.

The techniques disclosed herein separate “user authentication” and “access control” into two processes. In some configurations, the user authentication is delegated to a trusted service, such as Active Directory, to authenticate that a user is a member of a group and has full privileges of the group. Before each member is granted access to the vault, the group vault service takes dependency from this trusted authentication service and trusts the vouch from the authentication service regarding a requesting member to access the vault being a valid member of the group and therefore the group vault. In some aspects, a notable benefit of such techniques is the ability to provide a user to access a group vault from multiple devices associated with an authenticated user by the use of a single vault key.

In some configurations, a system can receive encrypted data, including encrypted secret data, an encrypted secret key, and encrypted vault key. The encrypted secret data can be generated from the secret data using a secret key. The encrypted secret key can be generated from the secret key by the use of a vault key that is associated with a group of users. The system can receive or generate the encrypted vault key, which is generated from the vault key by the use of a public key associated with a user of the group of users. The system can be configured to store the encrypted data only if the user is a current member of the group. The system can verify the user's membership status from a group manager, such as a system managing a channel or chat session. In response to verifying that the user is a current member of the group, the system can store the encrypted data in a storage vault associated with the group of users. The encrypted data can be shared with any member of the group. Each time a group member accesses the encrypted data, the system can verify a user's status with respect to a group. A group manager can provide information regarding each user's membership status and also provide permission definitions for each member. Thus, a vault can provide specific read/write privileges based on information received from a group manager.

It should be appreciated that the above-described subject matter may be implemented as a computer-controlled apparatus, a computer process, a computing system, or as an article of manufacture such as a computer-readable storage medium. These and various other features will be apparent from a reading of the following Detailed Description and a review of the associated drawings.

This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended that this Summary be used to limit the scope of the claimed subject matter. Furthermore, the claimed subject matter is not limited to implementations that solve any or all disadvantages noted in any part of this disclosure.

