Encrypt Microsoft OneDrive files with CTE

This document describes how to encrypt files in Microsoft OneDrive with CTE.

Use Cases

• Encrypt Microsoft OneDrive files with CTE for standard policies on a Windows server

Test Environment

• CTE Agent: 7.4.0

• CipherTrust Manager: 2.10.0

• OS: Windows 10 Azure VM (OneDrive is built into Windows 10)

• OneDrive setup (Host VM/OS) for other Windows platforms:

  1. Download the OneDrive Application from Microsoft and install it.

  2. Follow the steps in Sync files with OneDrive in Windows to sync the files using OneDrive.

Steps

To integrate CTE with Microsoft OneDrive:

1. Deploy a CipherTrust Manager in Microsoft Azure

2. Install and Register the CTE Agent

3. Encrypt data on a OneDrive folder with CTE

Deploy a CipherTrust Manager in Microsoft Azure

• Deploy a CipherTrust Manager in Microsoft Azure

Install and Register the CTE Agent

1. Install CTE Agent on a client system where OneDrive is mounted. Refer to CTE Agent Quick Start Guide for details.

2. Register the CTE Agent with the CipherTrust Manager deployed in Azure.

Encrypt data on a OneDrive folder with CTE

OneDrive Files On-Demand allows you to access all of your files in your OneDrive cloud storage without having to download them and use local storage space. If this is enabled, the files and folders are shown as Reparse Points locally. You can still see all of your files as online-only files in File Explorer, but they do not use local space. When you are connected to the Internet, you can use the files like every other file on your device.

Use Case 1: Encrypting new data in OneDrive

When creating a GuardPoint for new data, use a Standard Encryption policy to encrypt this data.

Policy Type		Standard
Security Rules
Line 1	Effect	Audit, Permit
Line 1	Action	all_ops
Process Set	OneDrive	C:\Users\winAdministrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe, C:\Windows\sysWOW64\OneDrive.exe
Security Rules
Line 2	Effect	Audit, Permit, ApplyKey
Line 2	Action	all_ops

After you create and guard a folder in OneDrive:

1. Create/copy files that should be encrypted to a backup file. The files, when viewed online are in encrypted form. Same files in VM (locally) – in clear.

2. After disabling the GuardPoint:

   • Files in OneDrive cloud – encrypted

   • Same files in VM (locally) – encrypted

3. After enabling the GuardPoint:

   • Files in OneDrive cloud – encrypted

   • Same files in VM (locally) – in clear

Use Case 2: Encrypting already existing data in OneDrive

For data that already exists in a OneDrive, you have to:

1. Create the GuardPoint and apply an initial transformation policy.

2. When initial transformation is finished, apply the Production policy.

3. Resume the OneDrive/CTE synchronization.

Policy Type	Data Transformation: Initial Transformation
Security Rules:
1	Effect	ApplyKey,Audit,Permit
1	Action	Key_op
2	Effect	Deny, Audit
2	Action	all_ops
Key Selection Rules	Clear_key
Data Transformation rules	key1

Policy Type		Data Transformation: Production
Security Rules
Line 1	Effect	Audit, Permit
Line 1	Action	all_ops
Process Set	OneDrive	C:\Users\winAdministrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe, C:\Windows\sysWOW64\OneDrive.exe
Security Rules
Line 2	Effect	Audit, Permit, ApplyKey
Line 2	Action	all_ops
Key Selection Rules		key1

See the CTE Data Transformation Guide for more information.