OneDrive for Business: Advanced File encryption (Fort Knox)

OneDrive for Business, Microsoft


First time you my have seen it at  SharePoint  Conference 2014 in Las Vegas (SPC 2014). There were two sessions about Advanced File Encryption in SharePoint Online. Newer days Microsoft has announced, that you will have these encryption, also called Fort Knox, on each document that you will store at SharePoint Online or OneDrive for Business. Yourself you will have nothing to do, all things are behind the scene.

I will try an explanation with some pictures and text:

advanced encryption Each document will be synchronized with the OneDrive for business technology in fragments to the cloud (SSL). And here you must know, you will have more fragments, if the document gets bigger. The document also will be shredded during transportation, and if you will make any change on the document later, only the deltas will synchronized.
advanced encryption: key generation For each fragment there will be a new key generated..

The picture shows here four keys for four fragments.

advanced encryption: Azure store The fragments with his content will stored  individually in an Azure store (SQL Azure) , here A to D
advanced encryption: Azure store Each fragment will be stored in another store.

in our example: Four fragments, four stores

advanced encryption: Azure store: encrypt each Azure store Each store will be encrypted with a new key and these keys will stored in a really big key store database along with another billion keys from other fragments, other documents from you, other document from your company and other documents from other tenants.
advanced encryption: new key generation The there will be a new key generated.
advanced encryption: encryption of the keys This new key encrypts the originally generated keys for each fragment.
advanced encryption: save the encrpted key in the conmtent database And these Key data were stored in the content database of the SharePoint Online.

Therefore a potential attacker will have some problems:

  • The content data are no more saved to the content database, only encrypted keys.
  • content is stored in millions of Azure stores, but only in fragments, each stored will be blocked with a separate key
  • All keys are stored in a key store database with billions other keys.
advanced encryption: Repeat the process each day. Exchange old keys if a possible attacker has enough time to analyze data…

no chance: All keys in the key store will  exchanged all 24 hours.


The user (and or the admin) never comes in touch with any of these keys or may seen it.

4 Gedanken zu “OneDrive for Business: Advanced File encryption (Fort Knox)

Kommentar verfassen

Trage deine Daten unten ein oder klicke ein Icon um dich einzuloggen:

Du kommentierst mit Deinem Abmelden /  Ändern )


Du kommentierst mit Deinem Twitter-Konto. Abmelden /  Ändern )


Du kommentierst mit Deinem Facebook-Konto. Abmelden /  Ändern )

Verbinde mit %s

Diese Seite verwendet Akismet, um Spam zu reduzieren. Erfahre, wie deine Kommentardaten verarbeitet werden..