Authorizing an untrusted client device for access on a content management system

• US 10,212,143 B2
• Filed: 01/31/2014
• Issued: 02/19/2019
• Est. Priority Date: 01/31/2014
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Allain, Francois Alexander, Tang, Jie
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Torres-Diaz, Lizbeth
• Application Number:
  US14/169,245
• Publication Number:
  US 20150222615A1
• Time in Patent Office: 1,845 Days
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

A method, system, and manufacture for authorizing an untrusted client device for access on a content management system. The content management system receives a request from an untrusted client device to access content on the content management system. The content management system sends an authentication key to the untrusted client device. The content management system then receives the authentication key from a trusted client device. Based on the matching authentication key, the content management system transmits data to the untrusted client device in accordance with any additional instructions that the trusted client device may have sent.

Claims

1. A synchronized online content management system comprising:

a processor; and

memory, including instructions that, when executed by the processor, cause the computing system to;

receive a request from a first client device to access content in an account in the synchronized online content management system, wherein the first client device is a client device authorized to access the content in the account;

send a first code to the first client device, the first code configured for playback on the first client device;

receive a second code from a second client device and determine a match between the first code and the second code, and in response to the match between the first code and the second code, restrict the second client device from accessing the content associated with the account of the first client device on the synchronized online content management system; and

receive, by the synchronized online content management system from the second client device, an instruction and data associated with the instruction for the account associated with the first client device;

deliver to the account associated with the first client device by the synchronized online content management system the data received from the second client device, by associating the data with the account associated with the first client device based upon a match between the first code and the second code.

2. The system of claim 1, wherein the second device data provides access to content, a token, or a content item.

3. The system of claim 1, wherein the first code is at least one of a text string, an optically machine-readable code, an image, a video, or a sound.

4. The system of claim 1, wherein the first code is active for a specified period of time.

5. The system of claim 1, wherein the instruction includes at least one content item and a delivery method.

6. The system of claim 5, wherein the instruction further includes an expiration time.

18. The system of claim 1, wherein the first code is received by the second client device subsequent to playback on the first client device.

7. A computer-implemented method comprising:

presenting, via a processor on a first client device, a first code received by an unauthorized application, the first code associated with an account of a content management system;

sending, from a second client device to the content management system, a second code from an authorized application associated with the account of the content management system; and

sending a request from the authorized application to the content management system to transmit a content item from the content management system to the unauthorized application on the first client device after a match between the first code and the second code is determined, and in further response to the match between the first code and the second code, the request denies access to the account by the unauthorized application and the unauthorized application of the first client device delivers, based on an instruction, a second content item to the content management system for delivery to the account of the second client device by associating the second content item with the account of the second client device.

8. The method of claim 7 further comprising:

authenticating with an account on the content management system.

9. The method of claim 8, wherein the authenticating occurs in response to an authentication request from the content management system after the first code is received at the first client device.

10. The method of claim 7, wherein presenting the first code on the first client device causes, at the second client device, at least one of receiving a text input, receiving an audio input, or capturing an image associated with the first code presented on a display on the first client device.

11. The method of claim 7, wherein the request further includes at least one of a delivery method or an expiration time.

12. A manufacture comprising:

a non-transitory computer-readable storage medium; and

a computer executable instruction stored on the non-transitory computer-readable storage medium which, when executed by a computing device, causes the computing device to perform a method comprising;

in response to receiving a request from a first client device to access content in an account on a server, transmitting to the first client device a first authentication key configured for presentation, wherein the first client device is a client device authorized to access the content in the account;

receiving a second authentication key from a second client device, wherein the second client device is an unauthorized client device to the account; and

receiving second content from the second client device;

determining a match between the first authentication key and the second authentication key, and based upon the match, permitting the second client device to deliver a second content to the server for the account and not authorizing the second client device to access the account after determining the match; and

transmitting data to the first client device from the server, the data configured based on the second content and an instruction received from the second client device.

13. The manufacture of claim 12, the method further comprising:

sending an authentication request to the second client device, the authentication request triggered in response to receiving the second authentication key from the second client device.

14. The manufacture of claim 12, wherein the data is at least one of a uniform resource locator (URL) providing access to at least one of the content, a token, or a content item.

15. The manufacture of claim 14, wherein the URL is deactivated after a predefined period of time.

16. The manufacture of claim 14, wherein the URL presents a user interface displaying a version of the content.

17. The manufacture of claim 16, the method further comprising:

refreshing the URL, the refreshing causing a display of a second version of the content.