Integrating security by obscurity with access control lists

• US 7,984,512 B2
• Filed: 06/14/2007
• Issued: 07/19/2011
• Est. Priority Date: 06/14/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bono, Joseph Andrew, Torres, Michael I, Flaks, Jason Scott, Schwartz, Jordan L. K.
• Primary Examiner(s): Shiferaw; Eleni A
• Application Number:
  US11/762,885
• Publication Number:
  US 20080313703A1
• Time in Patent Office: 1,496 Days
• Field of Search: 726/2, 726 26- 29, 705/57, 380/201
• US Class Current: 726/28
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/9574 of access to content, e.g. by caching
• CPC Class Codes: G06F 16/972 Access to data in other repository systems, e.g. legacy data or dynamic Web page generation
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Aspects of the subject matter described herein relate to providing and restricting access to content. In aspects, information (e.g., a URL) that identifies content and a user is provided to a user. In conjunction with providing the information to a user, a data structure (e.g., an access control list) is updated to indicate that the user has access to the content. The user may use the information to access the content and/or may send this information to other users. The other users may use the information (e.g., by pasting it into a browser) to access the content and may be added to the data structure so that they may subsequently access the content without the use of the information. Access to the content via using the information may be subsequently revoked.

Claims

1. At least one computer storage medium storing computer-executable instructions that, when executed by a computer, cause the computer to perform a method comprising:

providing, by the computer, information that identifies content and a first user, wherein the information includes a uniform resource locator (URL) that is associated with the content by a value of the URL, and wherein the value comprises an encryption of a content identifier and of a user identifier, and wherein the content identifier identifies the content, and wherein the user identifier identifies the first user;

updating, by the computer, a data structure to indicate that the first user has rights to access to the content;

receiving, in a request in response to the providing, at least a portion of the information from a second user;

determining, in response to the receiving, whether the second user desires to access the content anonymously or based on a second user identifier of the second user;

if anonymously, then granting the second user access to the content according to the rights of the first user; and

if based on the second user identifier, then;

obtaining the second user identifier of the second user,

updating, in response to the request and the obtaining, the data structure to indicate that the second user has rights to access to the content based on the value of the URL and based on a second user identifier of the second user,

granting the second user access to the content according to rights that are most permissive of the rights of the first user and the rights of the second user.

2. The at least one computer storage medium of claim 1, wherein the URL further includes a domain and a path of a server upon which the content resides.

3. The at least one computer storage medium of claim 1, wherein the information is provided from the first user to the second user via e-mail.

4. The at least one computer storage medium of claim 1, further comprising updating the data structure to indicate that at least one user is no longer allowed to access the content.

5. The at least one computer storage medium of claim 4, further comprising allowing the second user to access the content based on other information included in the data structure that grants access rights to the second user.

6. The at least one computer storage medium of claim 1, wherein the second user provides the at least a portion of the information without identifying the second user.

7. The at least one computer storage medium of claim 1, wherein the data structure comprises an access control list that associates access rights to the content with users.

8. The at least one computer storage medium of claim 1, further comprising tracking how many times the information is received and providing the how many times to an owner of the content.

9. The at least one computer storage medium of claim 1, wherein the content comprises an album that includes one or more images.

10. A method comprising:

receiving, by a computer, an indication that a user desires to share content with a set of users;

updating, by the computer, a data structure that associates identifiers with access rights to the content;

providing, by the computer, a link to each of the set of users, wherein the link is associated with the content by a value of the link, and wherein the value comprises an encryption of a content identifier and of a user identifier, and wherein the content identifier identifies the content, and wherein the user identifier identifies the user;

receiving, in response to the providing, the value in conjunction with a request from one of the set of users to access the content;

determining, in response to the receiving, that the one of the set of users desires to access the content based on an identifier of the one of the set of users;

updating, in response to the request and the determining, the data structure to indicate that the one of the set of users has rights to access the content based on the value of the URL and based on the identifier of the one of the set of users; and

granting the one of the set of users access to the content according to rights that are most permissive of the rights of the user and the rights of the one of the set of users.

11. The method of claim 10, further comprising revoking access rights to the content.

12. The method of claim 10, wherein the providing the link comprises sending an e-mail that includes the link to each of the other users.

13. The method of claim 10, wherein the content includes text, or a hyperlink, or multi-media content, or a file, or a data structure.

14. In a computing environment, an apparatus comprising:

a memory device configured to store identifiers and access rights, wherein each of the identifiers uniquely identifies a user, and wherein each of the identifiers is associated with at least one access right, and wherein each access right indicates rights granted to a corresponding user;

a permissions component configured to determine that a requestor is allowed to access content based on a value of a link, wherein the value comprises an encryption of a content identifier and of a user identifier, and wherein the content identifier identifies the content, and wherein the user identifier identifies a user;

a communications mechanism configured for receiving the value in conjunction with a request from the requestor to access the content;

the permissions component further configured for determining, in response to the receiving, that the requestor desires to access the content based on an identifier of the requestor;

a data sharing component configured for updating, in response to the request and the determining, the data structure to indicate that the requestor has rights to access the content based on the value of the URL and based on the identifier of the requestor;

the permissions component further configured for granting the requestor access to the content according to rights that are most permissive of the rights of the user and the rights of the requestor; and

a page builder configured to create a page for display based at least in part on the content and based on the value of the link and based on a requestor identifier of the requestor.

15. The apparatus of claim 14, wherein the permissions component is further configured to determine that the requestor is logged-on to a server that includes the content.

16. The apparatus of claim 14, further comprising a revocation component configured to revoke user access rights to the content.