ADVANCED SECURITY PROTOCOL FOR BROADCASTING AND SYNCHRONIZING SHARED FOLDERS OVER LOCAL AREA NETWORK

• US 20150249647A1
• Filed: 02/28/2014
• Published: 09/03/2015
• Est. Priority Date: 02/28/2014
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Mityagin, Anton, Litzenberger, Dwayne
• Granted Patent: US 9,641,488 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

A method, system, and manufacture for securely broadcasting shared folders from one client device to other client devices and synchronizing the shared folders over a local area network. A first client device, associated with a content management system, generates a secure identifier for a shared folder, using a shared secret key that is associated with the shared folder. The first client device announces the secure identifier over a local area network to other client devices on the local area network including a second client device. The first client device receives a synchronization request for the shared folder from the second client device. After authenticating, using the shared secret key, that the second client device has authorization to access the shared folder, the first client device synchronizes the shared folder with the second client device over the local area network.

Claims

1. A computer-implemented method comprising:

receiving, at a first client device from a content management system, a shared secret key associated with a shared folder;

generating, via at least one processor, a secure identifier based on the shared secret key; and

broadcasting the secure identifier to at least a second client device.

2. The computer-implemented method of claim 1, further comprising receiving, at the first client device from the content management system, a folder identifier associated with the shared folder.

3. The computer-implemented method of claim 1, wherein the secure identifier is generated using a pseudorandom function family.

4. The computer-implemented method of claim 1, wherein the secure identifier is broadcast over a local area network.

5. The computer-implemented method of claim 1, wherein the shared secret key comprises a secret string.

6. The computer-implemented method of claim 1, wherein generating the secure identifier is further based on a cryptographic nonce, and the method further comprising:

broadcasting the cryptographic nonce to at least the second client device.

7. The computer-implemented method of claim 1, wherein generating the secure identifier is further based on an indication of an expiration time, and the method further comprising:

broadcasting the indication to at least the second client device.

8. The computer-implemented method of claim 1, further comprising:

receiving a synchronization request for the shared folder from the second client device; and

in response to determining that the second client device has authorization to access the shared folder using the shared secret key, synchronizing the shared folder to the second client device over a local area network.

9. A non-transitory computer-readable medium storing computer executable instructions for causing a computer to perform the method comprising:

receiving, at a first client device from a content management system, a shared folder having a folder identifier and a shared secret key;

receiving a first secure identifier from a second client device;

generating a second secure identifier based on the shared secret key; and

when the first secure identifier matches the second secure identifier, associating the folder identifier with the second client device.

10. The non-transitory computer-readable medium of claim 9, wherein the second secure identifier is generated using a pseudorandom function family.

11. The non-transitory computer-readable medium of claim 9, wherein the first secure identifier is received over a local area network.

12. The non-transitory computer-readable medium of claim 9, wherein associating the folder identifier with the second client device yields an association, the method further comprising storing the association.

13. The non-transitory computer-readable medium of claim 9, wherein generating the second secure identifier is further based on an expiration time received from the second client device, and wherein the folder identifier is associated with the second client device only when the expiration time has not passed.

14. The non-transitory computer-readable medium of claim 9, wherein the second secure identifier is generated further based on a cryptographic nonce received from the second device.

15. The non-transitory computer-readable medium of claim 9, wherein the method further comprises:

sending a synchronization request for the shared folder to the second client device;

establishing a secure connection over a local area network with the second client device using the shared secret key; and

synchronizing the shared folder with the second client device via the secure connection.

16. A manufacture comprising:

a computer-readable medium; and

computer-readable instructions, stored on the computer-readable medium, that when executed are effective to cause a computer to;

generate, at a first client device, a secure identifier for a shared folder, using a shared secret key associated with the shared folder;

announce the secure identifier to at least a second client device;

receive a synchronization request for the shared folder from the second client device; and

in response to authenticating, using the shared secret key, that the second client device has authorization to access the shared folder, synchronize the shared folder with the second client device over a local area network.

17. The manufacture of claim 16, wherein the shared folder is also synchronized on a content management system, and wherein the first client device and the second client device are associated with the content management system.

18. The manufacture of claim 16, wherein the computer-readable instructions are effective to further cause the computer to announce the secure identifier to a plurality of client devices over the local area network.

19. The manufacture of claim 16, wherein the computer-readable instructions are effective to further cause the computer to authenticate, using the shared secret key, the second client device'"'"'s access to the shared folder.

20. The manufacture of claim 16, wherein generating the secure identifier is further based on at least one of a cryptographic nonce or an indication of an expiration time.