With this post, I would like to share a few techniques for you to do this.īefore we proceed further, it is important to note that user’s OneDrive account is private by default. The bottom line is – you need to access someone else’s OneDrive. Or, maybe someone just left on vacation and forgot to publish a very important Sales Proposal to SharePoint. Your employee left or is about to leave the organization, but has left lots of valuable intellectual property in his or her OneDrive repository. Without access to all three it is impossible to retrieve the keys to the chunks, decrypt the keys to make them usable, associate the keys with their corresponding chunks, decrypt any chunk, or reconstruct a document from its constituent chunks.Here is a scenario. This provides an unprecedented level of security. The information held in any one of the components is unusable on its own. It holds the map required to locate and reassemble all of the content blobs held in the blob store as well as the keys needed to decrypt those blobs.Įach of these three storage components-the blob store, the Content Database, and the Key Store-is physically separate. The Content Database is a SQL Server database. The content itself holds no clue as to how it can be decrypted. The key to each chunk of content is encrypted and stored separately in the content database. In other words, there are three different types of stores involved in per-file encryption at rest, each with a distinct function:Ĭontent is stored as encrypted blobs in the blob store. Each set of credentials is held in the secure Key Store and is regularly refreshed. The "map" used to re-assemble the file from its components is stored in the Content Database.Įach blob container has its own unique credentials per access type (read, write, enumerate, and delete). They also are randomly distributed across multiple blob containers. Updates are handled similarly: the set of changes, or deltas, submitted by a user is broken into chunks, and each is encrypted with its own key.Īll of these chunks-files, pieces of files, and update deltas-are stored as blobs in our blob store. Then, each chunk is encrypted using its own unique key. Each file to be stored is broken into one or more chunks, depending its size. Here's how that data is secured:Īll content is encrypted, potentially with multiple keys, and distributed across the datacenter. All customer content in OneDrive for Business and SharePoint Online will be migrated to blob storage. These credentials are stored in a separate physical location from either the content or the content keys.įor additional information about FIPS 140-2 compliance, see FIPS 140-2 Compliance.įile-level encryption at rest takes advantage of blob storage to provide for virtually unlimited storage growth and to enable unprecedented protection. The encrypted content is distributed across a number of containers throughout the datacenter, and each container has unique credentials. Every step of this encryption uses Advanced Encryption Standard (AES) with 256-bit keys and is Federal Information Processing Standard (FIPS) 140-2 compliant. The keys to the encrypted content are stored in a physically separate location from the content. Further, every update to every file is encrypted using its own encryption key. While BitLocker encrypts all data on a disk, per-file encryption goes even further by including a unique encryption key for each file. Per-file encryption is also in OneDrive for Business and SharePoint Online in Microsoft 365 multi-tenant and new dedicated environments that are built on multi-tenant technology. While this data is already transmitted by using a private network, it is further protected with best-in-class encryption.Įncryption at rest includes two components: BitLocker disk-level encryption and per-file encryption of customer content.īitLocker is deployed for OneDrive for Business and SharePoint Online across the service. For instance, SQL Server transaction logs and blob storage deltas travel along this pipe. All SSL connections are established using 2048-bit keys.ĭata movement between datacenters The primary reason to move data between datacenters is for geo-replication to enable disaster recovery. In OneDrive for Business and SharePoint Online, there are two scenarios in which data enters and exits the datacenters.Ĭlient communication with the server Communication to OneDrive for Business across the Internet uses SSL/TLS connections.
0 Comments
Leave a Reply. |