Advanced security protocol for broadcasting and synchronizing shared folders over local area network

• US 10,425,391 B2
• Filed: 04/10/2017
• Issued: 09/24/2019
• Est. Priority Date: 02/28/2014
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Mityagin, Anton, Litzenberger, Dwayne
• Primary Examiner(s): Sholeman, Abu S
• Application Number:
  US15/483,751
• Publication Number:
  US 20170214668A1
• Time in Patent Office: 897 Days
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

A method, system, and manufacture for securely broadcasting shared folders from one client device to other client devices and synchronizing the shared folders over a local area network. A first client device, associated with a content management system, generates a secure identifier for a shared folder, using a shared secret key that is associated with the shared folder. The first client device announces the secure identifier over a local area network to other client devices on the local area network including a second client device. The first client device receives a synchronization request for the shared folder from the second client device. After authenticating, using the shared secret key, that the second client device has authorization to access the shared folder, the first client device synchronizes the shared folder with the second client device over the local area network.

Claims

1. A computer-implemented method comprising:

receiving, at a first application on a first client device, from a content management system associated with the first application, a shared secret key generated at the content management system for a shared content item and a corresponding namespace identifier;

generating, via at least one processor of the first client device, a secure identifier that uniquely identifies the shared content item, the secure identifier being generated using the shared secret key and a cryptographic nonce as inputs, the cryptographic nonce being uniquely generated for an announcement message;

broadcasting, by the first application on the first client device, the announcement message to one or more client devices on a same local area network as the first client device, the announcement message comprising the secure identifier and the cryptographic nonce; and

based on a synchronization message associated with a second client device that is on the same local area network and has a copy of the shared content item and the shared secret key, initiating a synchronization of the shared content item between the first client device and the second client device via a local channel between the first client device and the second client device.

2. The computer-implemented method of claim 1, further comprising receiving, at the first client device from the content management system, a content item identifier associated with the shared content item.

3. The computer-implemented method of claim 1, wherein the announcement message is associated with multiple user accounts on the content management system.

4. The computer-implemented method of claim 1, wherein the announcement message is transmitted to all devices connected to the same local area network as the first client device, and wherein the shared secret key comprises a secret string.

5. The computer-implemented method of claim 1, wherein initiating the synchronization of the shared content item between the first client device and the second client device comprises synchronizing the shared content item directly between the first client device and the second client device.

6. The computer-implemented method of claim 1, wherein the cryptographic nonce is periodically renewed and never repeated or reused with other announcement messages.

7. The computer-implemented method of claim 1, wherein generating the secure identifier is further based on an indication of an expiration time, the method further comprising:

broadcasting the indication to at least the second client device.

8. The computer-implemented method of claim 1, wherein the synchronization message comprises a synchronization request for the shared content item, the method further comprising:

receiving the synchronization request from the second client device; and

in response to determining that the second client device has authorization to access the shared content item using the shared secret key, synchronizing the shared content item to the second client device over the same local area network.

9. A non-transitory computer-readable medium storing computer executable instructions which, when executed by one or more processors, cause the one or more processors to:

receive, at a first application on a first client device, from a content management system associated with the first application, a shared content item having a content item identifier and a shared secret key generated at the content management system for the shared content item;

receive, at the first application on the first client device, from a second application on a second client device, a first secure identifier associated with the shared content item;

generate, at the first application on first client device, a second secure identifier associated with the shared content item, the second secure identifier being generated using the shared secret key and a cryptographic nonce as inputs, the cryptographic nonce being uniquely generated for an announcement message;

broadcast, by the first application on the first client device, the announcement message to one or more client devices on a same local area network as the first client device, the announcement message comprising the second secure identifier and the cryptographic nonce; and

in response to a synchronization message associated with the second client device, initiate a synchronization of the shared content item between the first client device and the second client device via a local channel between the first client device and the second client device.

10. The non-transitory computer-readable medium of claim 9, wherein the announcement message is associated with multiple user accounts registered at the content management system.

11. The non-transitory computer-readable medium of claim 9, wherein the announcement message is transmitted to all devices connected to the same local area network.

12. The non-transitory computer-readable medium of claim 9, storing computer executable instructions which, when executed by the one or more processors, cause the one or more processors to, when the first secure identifier matches the second secure identifier, associate the content item identifier with the second client device, and wherein associating the content item identifier with the second client device yields an association.

13. The non-transitory computer-readable medium of claim 9, wherein generating the second secure identifier is further based on an expiration time received from the second client device, and wherein the content item identifier is associated with the second client device only when the expiration time has not passed.

14. The non-transitory computer-readable medium of claim 9, wherein the second secure identifier is generated further based on a second cryptographic nonce received from the second application on the second client device.

15. The non-transitory computer-readable medium of claim 9, wherein the synchronization message comprises a synchronization request for the shared content item, the non-transitory computer-readable medium storing computer executable instructions which, when executed by the one or more processors, cause the one or more processors to:

send the synchronization request for the shared content item to the second client device;

establish a secure connection over the same local area network with the second client device using the shared secret key, the secure connection comprising the local channel; and

synchronize the shared content item with the second client device via the secure connection.

16. A system comprising:

one or more processors;

at least one non-transitory computer-readable medium; and

computer-readable instructions stored on the at least one non-transitory computer-readable medium, that when executed by the one or more processors, cause the system to;

generate, at a first application associated with a content management system, a secure identifier for a shared content item, the secure identifier being generated using as inputs a shared secret key generated at the content management system for the shared content item and a cryptographic nonce that is uniquely generated for an announcement message;

broadcast, by the first application, the announcement message to one or more client devices on a same local area network as the first client device, the announcement message comprising the secure identifier and the cryptographic nonce; and

based on a synchronization message associated with a second client device that is on the same local area network and has a copy of the shared content item and the shared secret key, initiate a synchronization of the shared content item between the first client device and the second client device via a local connection between the first client device and the second client device.

17. The system of claim 16, wherein the shared content item is synchronized with a copy of the shared content item on the content management system, and wherein the first client device and the second client device are associated with the content management system.

18. The system of claim 16, wherein the announcement message is transmitted to all devices connected to the local area network as the first client.

19. The system of claim 16, wherein the computer-readable instructions when executed by the one or more processors cause the system to authenticate, using the shared secret key, the second client device for access to the shared content item.

20. The system of claim 16, wherein the announcement message is associated with multiple user accounts.