SANDBOXING INDIVIDUAL APPLICATIONS TO SPECIFIC USER FOLDERS IN A CLOUD-BASED SERVICE

• US 20140082071A1
• Filed: 03/14/2013
• Published: 03/20/2014
• Est. Priority Date: 09/18/2012
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Rexer, Peter
• Granted Patent: US 9,553,758 B2
• Time in Patent Office: Days
• US Class Current: 709/204
• CPC Class Codes: G06F 16/183 Provision of network file services by network file servers, e.g. by using NFS, CIFS network file access protocols H04L67/1097
• CPC Class Codes: G06F 16/192 Implementing virtual folder structures
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

An example system and method comprises receiving a request from the third-party application, wherein the request includes a user identifier; allocating an area that is specific for the third-party application and for the user; and granting access of the area to the third-party application. In one embodiments, the method further comprises providing to the third-party application a token which allows the third-party application to access a given area. Additional embodiments provided herein enable a third-party application to use a user identifier (e.g., an email address or other identifiers) of its user to access area specific of a cloud-based environment/platform/services (e.g., collaboration, file sharing, and/or storage services) without necessarily triggering user account authentication, thereby avoiding the process of requiring access codes from the user which can adversely impact user experience as well as compromise security and/or user'"'"'s privacy.

Claims

1. A method for providing a folder to a third-party application for a user in a cloud-based environment, the method comprising:

receiving, at a server which provides the cloud-based environment, a request from the third-party application, wherein the request includes a user identifier;

allocating, on the server, an area that is specific for the third-party application and for the user; and

granting access of the area to the third-party application in the cloud-based environment.

2. The method of claim 1, wherein the access of the third-party application in the cloud-based application is specific to the area.

3. The method of claim 1, wherein the granting comprises:

providing to the third-party application a token which allows the third-party application to access the area exclusively.

4. The method of claim 1, wherein the granting comprises:

encrypting content of the area; and

decrypting the content of the area in response to the third-party application presenting a token that is valid.

5. The method of claim 1, wherein, if a work space associated with the user exists in the cloud-based environment, the allocating and granting are performed without requiring a password to the work space.

6. The method of claim 1, wherein, if a work space associated with the user already exists on the server,

when the server operates in a first mode, the allocating is performed without authentication to access the work space;

and

when the server operates in a second mode, the method further comprises authorizing the user, and the allocating is performed when the user is authorized.

7. The method of claim 1, wherein the allocating is based on the user identifier and comprises:

determining whether a work space associated with the user identifier already exists;

if the work space does not exist, (i) allotting an amount of space on the server as the work space, and (ii) establishing the area in the work space.

8. The method of claim 1, wherein the allocating is based on the user identifier and comprises:

determining whether a work space associated with the user identifier already exists; and

if the work space already exists, prompting the user to give a permission to establish the area in the work space for the third-party application.

9. The method of claim 8, further comprising:

revoking the access upon the user deleting the area from the work space.

10. The method of claim 1, further comprising:

before the allocating and the granting, verifying a consent of the user.

11. The method of claim 10, wherein the request includes the consent.

12. The method of claim 1, wherein the server restricts the user from modifying content of the area.

13. The method of claim 1, wherein the third-party application includes a web-based application or a widget.

14. The method of claim 1, wherein the cloud-based environment includes a cloud-based collaboration environment.

15. The method of claim 1, wherein the cloud-based environment includes a cloud-based storage service or file sharing service.

16. A system for providing a folder to a third-party application for a user in a cloud-based platform, the system comprising:

a processor; and

a memory coupled to the processor and storing a plurality of instructions which, when executed by the processor, cause the processor to;

receive a request from the third-party application, wherein the request includes a user identifier that identifies the user; and

allocate an area that is specific for the third-party application and for the user.

17. The system of claim 16, wherein the instructions further cause the processor to:

grant a specific area to be accessed by the third-party application.

18. The system of claim 17, wherein the instructions further cause the processor to:

encrypt content of the area; and

decrypt the content of the area in response to the third-party application presenting a token;

wherein, the token is used by the third-party application to access the specific area.

19. The system of claim 16, wherein, if a work space associated with the user already exists on the server, the processor is to allocate the area and to grant the access without requiring a password to the work space.

20. The system of claim 16, wherein the processor is to allocate based on the user identifier, and wherein the instructions further cause the processor to:

determine whether a work space associated with the user identifier already exists;

if the work space does not exist, (i) allot an amount of space on the server as the work space, and (ii) establish the area in the work space.

21. The system of claim 16, wherein the processor is to allocate based on the user identifier, and wherein the instructions further cause the processor to:

determine whether a work space associated with the user identifier already exists; and

if the work space already exists, prompt the user to give permission to establish the area in the work space for the third-party application.

22. The system of claim 21, wherein the instructions further cause the processor to:

revoke the access upon the user deleting the area from the work space.

23. A mobile device having access to a cloud-based environment, the device comprising:

a processor;

memory coupled to the processor having stored thereon instructions which, when executed by the processor, cause the processor to;

execute, on the mobile device, a mobile client to access the cloud-based environment which provides access to an application via the mobile device;

wherein the mobile client creates an area, on the mobile device, that is specific for the third-party application and for the user.

24. The mobile device of claim 23, wherein, the application receives a token to access the area specifically allocated to the application.

25. The mobile device of claim 24, wherein, the token is received from a server hosting the cloud-based environment

26. The mobile device of claim 23, wherein the token is used to decrypt content of the area for access by the application.

27. A system for providing a folder to a third-party application for a user in a cloud-based platform, the system comprising:

means for receiving a request from the third-party application, wherein the request includes a user identifier that identifies the user;

means for allocating an area that is specific for the third-party application and for the user; and

means for granting access of the area to the third-party application, wherein the access specific to the area in the cloud-based environment.

28. The system of claim 27, further comprising:

means for providing to the third-party application a token which enables the third-party application to access the area.

29. The system of claim 27, further comprising:

means for encrypting content of the area; and

means for decrypting the content of the area in response to the third-party application presenting the token.

30. The system of claim 27, further comprising:

means for determining whether a work space associated with the user identifier already exists; and

means for allotting an amount of space on the server as the work space and for establishing the area in the work space if the work space does not already exist.

31. The system of claim 30, further comprising:

means for prompting the user to give a permission to establish the area in the work space for the third-party application if the work space already exists.

32. The system of claim 27, wherein the cloud-based environment includes a cloud-based collaboration environment.

33. The system of claim 27, wherein the cloud-based environment includes a cloud-based storage service or file sharing service.