SYSTEM AND METHOD FOR EMBEDDING FIRST PARTY WIDGETS IN THIRD-PARTY APPLICATIONS

• US 20150200952A1
• Filed: 03/25/2015
• Published: 07/16/2015
• Est. Priority Date: 06/26/2012
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Cairns, Brian Lewis, Schoeffler, Eric Benson, Procopio, Michael Jeffrey, Chou Fritz, Victoria Hsiao-Tsung
• Granted Patent: US 9,860,253 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/00 Network arrangements or protocols for supporting network services or applications user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Methods and systems provide embeddable user interface widgets to third-party applications so that the widgets can be securely embedded in, and securely used from within, the third-party applications. An embeddable widget may be authorized to access a first-party cloud storage system from a third-party application based on the cloud storage system authenticating a request received from the widget. The authentication may be based on an application identifier, an origin identifier, and/or one or more document identifiers received from the third-party application through the embedded widget. The disclosed methods and systems may significantly mitigate security concerns caused by embedding software in third-party sites, such as clickjacking.

Claims

1-20. -20. (canceled)

21. A method for providing access to files stored on a server, the method comprising:

receiving, from a browser at a client device, a request for a file stored on the server, wherein the request includes;

a document identifier associated with the file,

an application identifier, and

an origin identifier;

determining that the origin identifier and the document identifier are both associated with the application identifier; and

based on the determining, granting the browser access to the file.

22. The method of claim 21, wherein:

the request is received from a first user at the browser;

the request includes an identifier of a second user; and

the method further comprises granting access to the second user.

23. The method of claim 21, wherein the request is received from a frame embedded in a web page displayed by the browser.

24. The method of claim 23, wherein the origin identifier is associated with the web page.

25. The method of claim 23, further comprising:

providing a copy of the file to a second server hosting the web page.

26. A method for providing access to files stored on a server, the method comprising:

receiving, from a browser at a client device, a first request for a file stored on the server;

sending a second request to the server, wherein the second request includes;

a document identifier associated with the file,

an application identifier, and

an origin identifier; and

receiving access to the file.

27. The method of claim 26, wherein:

the first request is received from a first user at the browser;

the first and second requests include an identifier of a second user; and

the method further comprises granting access to the second user.

28. The method of claim 26, wherein the first request is received from a web page displayed by the browser;

and

the first request is received at a frame embedded in the web page.

29. The method of claim 28, wherein the origin identifier is associated with the web page.

30. The method of claim 28, further comprising:

receiving a copy of the file from the server; and

providing the copy to a second server hosting the web page.

31. A system for providing access to files stored on a server, the system comprising:

one or more processors; and

memory storing one or more programs for execution by the one or more processors, the one or more programs comprising instructions for;

receiving, from a browser at a client device, a request for a file stored on the server, wherein the request includes;

a document identifier associated with the file,

an application identifier, and

an origin identifier;

determining that the origin identifier and the document identifier are both associated with the application identifier; and

based on the determining, granting the browser access to the file.

32. The system of claim 31, wherein:

the request is received from a first user at the browser;

the request includes an identifier of a second user; and

the method further comprises granting access to the second user.

33. The system of claim 31, wherein the request is received from a frame embedded in a web page displayed by the browser.

34. The system of claim 33, wherein the origin identifier is associated with the web page.

35. The system of claim 33, the one or more programs further comprising instructions for:

providing a copy of the file to a second server hosting the web page.

36. A system for providing access to files stored on a server, the system comprising:

one or more processors; and

memory storing one or more programs for execution by the one or more processors, the one or more programs comprising instructions for;

receiving, from a browser at a client device, a first request for a file stored on the server;

sending a second request to the server, wherein the second request includes;

a document identifier associated with the file,

an application identifier, and

an origin identifier; and

receiving access to the file.

37. The system of claim 36, wherein:

the first request is received from a first user at the browser;

the first and second requests include an identifier of a second user; and

the method further comprises granting access to the second user.

38. The system of claim 36, wherein

the first request is received from a web page displayed by the browser;

and

the first request is received at a frame embedded in the web page.

39. The system of claim 38, wherein the origin identifier is associated with the web page.

40. The system of claim 38, the one or more programs further comprising instructions for:

receiving a copy of the file from the server; and

providing the copy to a second server hosting the web page.