Google Drive

I. Encryption Flow: Creating or Editing a Document

When a user creates or modifies a Google document, the following "Wrap" process occurs:

1. DEK Generation: Google generates a unique Data Encryption Key (DEK) specifically for that document.

2. Content Encryption: Google encrypts the document content using this local DEK.

3. Key Protection Request: Google sends the DEK to Oten KMS for secure protection.

4. Key Wrapping: Oten KMS wraps (encrypts) the DEK using your Customer Managed Key (CMK) stored securely in the KMS.

5. Secure Storage: Google stores the encrypted document alongside the wrapped DEK. Google never has access to the plain-text CMK or DEK.

II. Decryption Flow: Accessing an Encrypted Document

When an authorized user opens an encrypted document, the following "Unwrap" process occurs:

1. Data Retrieval: Google retrieves the encrypted document and the associated wrapped DEK.

2. Authorization Request: Google forwards the wrapped DEK to Oten KMS.

3. Key Unwrapping: Oten KMS verifies the user's identity and authorization, then unwraps (decrypts) the DEK using the corresponding CMK.

4. Content Decryption: Google receives the plain-text DEK and uses it to decrypt the document content in the browser memory.

5. Seamless Access: The user views and interacts with the document normally within Google Workspace, ensuring a seamless yet secure experience.

III. Maximize feature potential

• To optimize the use of this features across browsers and mobile apps, please configure your settings as follows:

  • For mobile app:

    • Update the related apps to the latest version for the best experience (example: Gmail is 6.0.260406).

    • Chrome is the recommended default browser.

    • Android: If it does not work properly in the app, clear the cache and try again.

  • For desktop app browser: Chrome (or Chromium core browser) is the recommended default browser.

• These features work reliably in web browsers. On the mobile app, availability depends on the app version and Google's support, so usage may vary by version and is not always consistent.

IV. Supported services, applications, and data types when using Google CSE

Service	Apps	Data that's client-side encrypted	Data that's not client-side encrypted
Google Drive and Google Docs Editors	Web browser Drive for Desktop (non-Google file formats only) Android mobile app iOS mobile app Note: For mobile apps, client-side encrypted content is view-only and available for non-Google file formats only. For Android only, viewing files in .xlsx format is not supported. For mobile app: Chrome is the recommended default browser.	Files created with Google Docs Editors (documents, spreadsheets, presentations) Uploaded files, like PDFs and Microsoft Office files	File title File metadata, such as owner, creator, and last-modified time Drive labels (also called Drive metadata) Linked content that's outside of Docs or Drive (for example, a YouTube video linked from a Google document) User preferences, such as Docs header styles