Creating an application in which all user content is encrypted

Question

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content such as legal docs, in which there is a need to keep information confidential for third parties.

The protected data should be the content say of Word docs, some metadata such as author (Lawyer), involved parties and maybe trial type would be searchable and not encrypted but the details and content of the document will be.

It would be visible/decrypt-able by the person (lawyer) who wrote it, by its associates if given permission and by the client (one of the parties in the document).

Ideally the metadata would be extracted and the the content encrypted for subsequent upload and storage

Answer 1

This depends entirely on what you need the application to do, exactly what data needs to be protected, and who is permitted to view the data.

In the simplest case, where your application is merely an indexing system for documents and the document metadata can be stored in the clear, you can use client-side encryption to protect the document itself: the encryption key never leaves the user's computer, so it's not possible for anyone else to read the document.

In the extreme, you'll need to look into homomorphic encryption. This permits you to operate on encrypted data without knowing what that data is, but it's incredibly slow, and so cutting-edge that most of the security implications are currently unknown.

Your needs probably lie somewhere in between; you'll need to define your problem better before you can decide what solution to use.

Answer 2

Have a look at identity based encryption. Basically you could just use asymmetric encryption to achieve what you want. For example: encrypt everything you put on Facebook. Proof of concept: develop a plugin for Chrome which encrypts everything before it is uploaded to facebook with your private key. You spread your public key to your users. They use the plugin too and use your public key to decrypt your info on facebook. This way the FB servers only get encrypted useless data and your friends can still see the info you put on FB using the plugin and your public key.