Systems and methods of cloud encryption

A computer-implemented system that monitors and controls exfiltration of documents stored on a cloud computing service (CCS), the system comprising:

• a processor and a non-transitory computer readable storage medium storing computer instructions configured to cause the processor to:
• use a cross-application monitor to detect
• a cloud computing service (CCS) application programming interface (API) in use;
• and
• a function or an activity being performed via the CCS API on a document;
• determine the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identify content in the document being transmitted to the CCS;
• apply a content inspection rule to find strings and interrelated strings in the content that are subject to content control;
• provide a triplet of an organization ID of an organization that uses the CCS, a CCS ID, and a region ID as input to a first key-manager, and in response to the input, the first key-manager generating a triplet-key;
• and
• encrypt the document, using a per-document key derived by applying a key derivation function (KDF) to the triplet-key, a document identifier (ID), and a salt, responsive to finding the strings and interrelated strings subject to content control in the parsed stream.

One or more non-transitory computer readable media having instructions stored thereon for performing a method of monitoring and controlling exfiltration of documents stored on a cloud computing service (CCS), the method including:

• using a cross-application monitor to detect
• a cloud computing service (CCS) application programming interface (API) in use;
• and
• a function or an activity being performed via the CCS API on a document;
• determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content in the document being transmitted to the CCS;
• applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control;
• providing a triplet of an organization ID of an organization that uses the CCS, a CCS ID, and a region ID as input to a first key-manager, and in response to the input, the first key-manager generating a triplet-key;
• and
• encrypting the document, using a per-document key derived by applying a key derivation function (KDF) to the triplet-key, a document identifier (ID), and a salt, responsive to finding the strings and interrelated strings subject to content control in the parsed stream.