INVITATION LINKS WITH ENHANCED PROTECTION

• US 20150288701A1
• Filed: 03/31/2015
• Published: 10/08/2015
• Est. Priority Date: 04/02/2014
• Status: Active Grant

• Current Assignee: CTERA Networks Limited
• Original Assignee: CTERA Networks Limited
• Inventors: Brand, Aron
• Granted Patent: US 11,122,047 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method and system for providing invitation links with enhanced protection are presented. The method includes sending, to at least one invitee, at least one invitation link for accessing the protected resource, wherein the at least one invitation link includes a secret invitation code encoded therein, wherein the secret invitation code is unique to each invitee, the invitation link is sent to the at least one invitee through a primary communication channel; upon detecting an attempt to access the at least one invitation link, determining whether the encoded secret invitation code matches a known secret invitation code; upon determining that the secret invitation code matches the known secret invitation code, performing a verification process to authenticate the invitee via a secondary channel of communication; and upon determining that the verification process has been passed, granting access to the protected resource.

Claims

1. A method for providing invitation links to access a protected resource, comprising:

sending, to at least one invitee, at least one invitation link for accessing the protected resource, wherein the at least one invitation link includes a secret invitation code encoded therein, wherein the secret invitation code is unique to each invitee, the invitation link is sent to the at least one invitee through a primary communication channel;

upon detecting an attempt to access the at least one invitation link, determining whether the encoded secret invitation code matches a known secret invitation code;

upon determining that the secret invitation code matches the known secret invitation code, performing a verification process to authenticate the invitee via a secondary channel of communication; and

upon determining that the verification process has been passed, granting access to the protected resource.

2. The method of claim 1, wherein upon determining that the secret invitation code matches the known secret invitation code further comprising:

determining based on the invitation code and verification provisions, if a verification process is required.

3. The method of claim 2, wherein the verification provisions include at least a verification requirement set for the invitee and an expiration time of the matching invitation link.

4. The method of claim 1, wherein the primary communication channel is different than the secondary communication channel.

5. The method of claim 1, wherein the verification process further comprises:

generating a verification challenge;

sending a verification message including the verification challenge via the secondary communication channel; and

upon receiving a valid response to the verification challenge, determining that the verification process has been passed.

6. The method of claim 5, wherein the verification challenge includes any one of:

a random number, a temporary link, a voice prompt, and a token.

7. The method of claim 1, wherein granting access to the protected resource further comprises:

sending a persistent cookie to the invitee device.

8. The method of claim 7, wherein upon subsequent access attempts to the invitation link further comprises:

determining if a valid persistent security cookie has been received; and

upon determining that the valid persistent security cookie has been received,

bypassing the verification challenge, identifying the invitee device as trusted, and

granting access to the protected resource.

9. The method of claim 8, further comprising:

identifying the invitee device as untrusted after a predefined period of time.

10. The method of claim 1, further comprising:

setting a maximum usage counter being decreased for each access granted to the protected resource;

upon detecting an attempt to access the protected resource, determining whether the maximum usage counter is greater than zero; and

upon determining that the maximum usage counter is not greater than zero, revoking the invitation link.

11. The method of claim 5, further comprising:

determining if the invitee device meets at least one pre-admission security check requirement; and

upon determining that the invitee device does not meet the at least one pre-admission security check requirement, determining that the verification challenge has not been passed.

12. The method of claim 1, wherein the at least one invitation link is generated and sent based on a collaboration policy.

13. The method of claim 11, wherein the at least one invitation link is generated and sent upon compliance with a collaboration policy.

14. The method of claim 13, wherein the collaboration policy defines a set of invitation permissions for external users outside of a predefined group of users, wherein the set of invitation permissions include at least one of:

a permission level, a required verification, and at least one challenge restrictions.

15. The method of claim 1, wherein the protected resource is at least one of:

a file and folder stored in a hybrid cloud storage system

16. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1.

17. A system for providing invitation links with enhanced protection, comprising:

a processing unit; and

a memory, the memory containing instructions that, when executed by the processing unit, configure the system to;

send, to at least one invitee, at least one invitation link for accessing a protected resource, wherein the at least one invitation link includes a secret invitation code encoded therein, wherein the secret invitation code is unique to each invitee, the invitation link is sent to the at least one invitee through a primary communication channel;

upon detecting an attempt to access the at least one invitation link, determine whether the encoded secret invitation code matches a known secret invitation code;

upon determining that the secret invitation code matches the known secret invitation code, perform a verification process to authenticate the invitee via a secondary channel of communication; and

upon determining that the verification process has been passed, grant access to the protected resource.

18. The system of claim 17, wherein when performing the verification process the system is further configured to:

generate a verification challenge;

send a verification message including the verification challenge via the secondary communication channel; and

upon receiving a valid response to the verification challenge, determine that the verification process has been passed.

19. The system of claim 17, wherein upon subsequent access attempts to the invitation link, the system is further configured to:

determine if a valid persistent security cookie has been received; and

upon determining that the valid persistent security cookie has been received, bypass the verification challenge, identify the invitee device as trusted, and grant access to the protected resource.

20. A method for generating invitation links with enhanced protection, comprising:

determining a protected resource to which the invitation link will provide access, wherein the protected resource is identified by a protected resource identifier;

generating a secret invitation code being unique for each invitee;

encoding the secret invitation code and the protected resource identifier in the invitation link; and

storing the generated secret invitation code and the invitation link.

21. The method of claim 20, wherein the verification challenge includes any one of:

a random number, a temporary link, a voice prompt, and a token.

22. A system for generating invitation links with enhanced protection, comprising:

a processing unit; and

a memory, the memory containing instructions that, when executed by the processing unit, configure the system to;

determine a protected resource to which the invitation link will provide access, wherein the protected resource is identified by a protected resource identifier;

generate a secret invitation code being unique for each invitee;

encode the secret invitation code and the protected resource identifier in the invitation link;

store the generated secret invitation code and the invitation link.

23. A method for a secured registration process, comprising:

sending, to at least one invitee, at least one invitation link for registering for a service, wherein the at least one invitation link includes a secret invitation code encoded therein, wherein the secret invitation code is unique to each invitee, the at least one invitation link is sent to the at least one invitee through a primary communication channel;

upon detecting an attempt to access the at least one invitation link, determining whether the encoded secret invitation code matches a known secret invitation code;

upon determining that the known secret invitation code is found, displaying a registration process; and

performing a verification process to authenticate the invitee via a secondary channel of communication.

24. The method of claim 23, wherein the verification process further comprises:

generating a verification challenge;

sending a verification message including the verification challenge via the secondary communication channel; and

upon receiving a valid response to the verification challenge, determining that the verification process has been passed.

25. The method of claim 24, wherein the service is at least a cloud storage service.

26. A system for a secured registration process, comprising:

a processing unit; and

a memory, the memory containing instructions that, when executed by the processing unit, configure the system to;

send, to at least one invitee, at least one invitation link for registering for a service, wherein the at least one invitation link includes a secret invitation code encoded therein, wherein the secret invitation code is unique to each invitee, the at least one invitation link is sent to the at least one invitee through a primary communication channel;

upon detecting an attempt to access the at least one invitation link, determine whether the encoded secret invitation code matches a known secret invitation code;

upon determining that the known secret invitation code is found, display a registration process; and

perform a verification process to authenticate the invitee via a secondary channel of communication.

27. The system of claim 26, wherein when performing the verification process the system is further configured to:

generate a verification challenge;

send a verification message including the verification challenge via the secondary communication channel; and

upon receiving a valid response to the verification challenge, determine that the verification process has been passed.