# US 2014/0208124 A1 · High privacy of file synchronization with sharing functionality > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208124 A1 - Document ID: US20140208124A1 - Status: Published application - Kind: A1 - Application number: 14/223,888 - Filed: 2014-03-24 - Published: 2014-07-24 - Earliest claimed: 2012-03-30 - Assignees: Decho Corporation; VMware, Inc. - Applicants: Decho Corporation; Vmware, Inc. - Inventors: David John HARTLEY - Web page: https://patentgrep.com/patent/US20140208124A1 ## CPC - G06F 21/602: {Providing cryptographic facilities or services} - G06F 16/16: File or folder operations, e.g. details of user interfaces specifically adapted to file systems - G06F 16/176: Support for shared access to files; File sharing support - G06F 16/178: Techniques for file synchronisation in file systems - G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for providing privacy of file synchronization with sharing functionality are presented. In embodiments, a file synchronization system comprises one or more folders associated with one or more non-shared encryption keys, which may be a managed key shared across an organization, and/or a personal key that is not shared or has limited third-party sharing. The one or more non-shared encryption keys are not known to the data storage service. The file synchronization system may also include one or more folders associated with a shared encryption key that is shared with the data storage service, and in embodiments, with a set of users of the service. The system may include a mapping correlating folders to encryption type so items in each folder can be handled appropriately. The system may have additional folders, such as one or more public folders that may be available with limited or no restrictions. ## Claims ### Claim 1 A synchronization system client for synchronizing files and providing sharing capabilities, comprising: at least one not-shared-key folder for storing items to be encrypted with a not-shared key and to be synchronized with a remote datastore, wherein the not-shared key is not shared with the remote datastore; at least one shared-key folder for storing items to be encrypted with a shared key and to be synchronized with the remote datastore, wherein at least the client system and the remote datastore have access to the shared key; a folder encryption map that associates the not-shared key with the at least one not-shared-key folder and associates the shared key with the at least one shared-key folder; and a differential encryption component that, responsive to an item changing within at least one of the at least one not-shared-key folder and the at least one shared-key folder, interfaces with the folder encryption map to access and encrypt the item to be transmitted to and stored at the remote datastore. ### Claim 2 (depends on 1) The synchronization system client of claim 1 wherein the not-shared key is a managed key shared within a client organization but not shared with the remote datastore. ### Claim 3 (depends on 1) The synchronization system client of claim 1 wherein the not-shared key is a personal key that is not shared with third parties. ### Claim 4 (depends on 1) The synchronization system client of claim 1 wherein the folder encryption map further comprising: storing an encryption algorithm setting for at least one folder of the at least one not-shared-key folder and the at least one shared-key folder. ### Claim 5 (depends on 1) The synchronization system client of claim 1 further comprising: an encryption key store that stores the non-shared key and the shared key and securely provides the differential encryption component with access to the keys. ### Claim 6 (depends on 1) The synchronization system client of claim 1 further comprising: a controls module that facilitates setting one or more policies related to at least the shared-key folder. ### Claim 7 (depends on 6) The synchronization system client of claim 6 wherein the controls module sets a policy restricting which files can be put into the shared-key folder. ### Claim 8 (depends on 6) The synchronization system client of claim 6 wherein the controls module sets a policy restricting one or more identified items in the shared-key folder in the remote storage to be viewable only to a third party with whom the one or more identified items have been shared. ### Claim 9 (depends on 6) The synchronization system client of claim 6 wherein the control module receives audit data related to items in the shared-key folder in the remote datastore. ### Claim 10 (depends on 1) The synchronization system client of claim 1 further comprises: at least one unencrypted folder for storing items that are unencrypted and to be synchronized with a remote datastore. ### Claim 11 (depends on 10) The synchronization system client of claim 10 wherein at least some of the files within the at least one unencrypted folder at the remote datastore are publicly accessible. ### Claim 12 A datastore managing system operating on one or more service provider computer systems for providing storage and sharing capabilities, comprising: at least one managed-key folder for a first client for storing items encrypted with a managed key, wherein the datastore managing system does not have access to the managed key; and at least one shared-key folder for the first client for storing items encrypted with a shared key, wherein at least the first client and the datastore managing system have access to the shared key; and a folder encryption map that correlates which encryption should be applied to items in the at least one managed-key folder and to items in the at least one shared-key folder. ### Claim 13 (depends on 12) The datastore managing system of claim 12 further comprising: a folder controls manager that allows sharing access to items in a folder to a second client responsive to receiving instructions from the first client to allow the second client sharing access to the folder. ### Claim 14 (depends on 13) The datastore managing system of claim 13 wherein: responsive to an item in the folder shared with the second client being in a managed-key folder, transmitting from the datastore managing system to the second client the item encrypted with the managed key, the second client knowing that the item is encrypted with the managed key based upon its position within the managed-key folder and having access to the managed key to unencrypt the item; and responsive to an item in the folder shared with the second client being in a shared-key folder, transmitting from the datastore managing system to the second client the item encrypted with the shared key, the second client system knowing that the item is encrypted with the shared key based upon its position within the shared-key folder and having access to the shared key by being a user of the datastore managing system. ### Claim 15 (depends on 12) The datastore managing system of claim 12 further comprising: a client installation module that, when executed on a client system causes the client system to generate elements comprising: at least one managed-key folder for storing items to be encrypted with a managed-key and to be synchronized with the datastore managing system, wherein the managed key is not shared with the datastore managing system; at least one shared-key folder for storing items to be encrypted with a shared key and to be synchronized with the datastore managing system, wherein at least the client system and the datastore managing system have access to the shared key; a folder encryption map that associates the managed key with the at least one managed-key folder and associates the shared key with the at least one shared-key folder; and a differential encryption component that, responsive to an item changing within at least one of the at least one managed-key folder and the at least one shared-key folder, interfaces with the folder encryption map to access and encrypt the item to be transmitted to and stored at the datastore managing system. ### Claim 16 (depends on 15) The datastore managing system of claim 15 wherein the client module further comprises: a controls module that facilitates setting one or more sharing policies related to one or more folders. ### Claim 17 (depends on 16) The datastore managing system of claim 16 wherein the control module receives audit data related to items in the shared-key folder in the datastore managing system. ### Claim 18 A computer-implement method comprising: providing a client installation module that when executed causes the steps to be performed comprising: generating at least one not-shared-key folder that is associated with a not-shared key that is used to securely encrypt or unencrypt items in the not-shared-key folder, which not-shared key is accessible by at least one client system but not accessible by a datastore system with which the not-share-key folder is remotely stored; generating at least one shared-key folder that is associated with a shared key that is used to securely encrypt or unencrypt items in the shared-key folder, which shared key is accessible by at least one client system and accessible by the datastore system with which the share-key folder is remotely stored; and maintaining a folder encryption map that maps which encryption key should be applied based upon whether an item is associated with the at least one not-shared-key folder or associated with the at least one shared-key folder. ### Claim 19 (depends on 18) The computer-implement method of claim 18 wherein the at least one not-shared-key folder comprises at least one of: at least one managed-key folder that is associated with a managed key that is used to securely encrypt or unencrypt items in the manage-key folder, which managed key is accessible by at least one client system within a common organization but is not accessible by the datastore system with which the managed-key folder is remotely stored; and at least one personal-key folder that is associated with a personal key that is used to securely encrypt or unencrypt items in the personal-key folder, which personal key is accessible by a client system but not accessible by the datastore system with which the personal-key folder is remotely stored. ### Claim 20 (depends on 18) The computer-implement method of claim 18 further comprising: responsive to receiving notification of a change to at least one item within at least one of the at least one not-shared-key folder and the at least one shared-key folder, using the folder encryption map and an identification of the folder within which the at least one item that changed resides to identify a key to be used on the least one item that changed.