ADVANCED SECURITY PROTOCOL FOR BROADCASTING AND SYNCHRONIZING SHARED FOLDERS OVER LOCAL AREA NETWORK

• US 20170214668A1
• Filed: 04/10/2017
• Published: 07/27/2017
• Est. Priority Date: 02/28/2014
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Litzenberger, Dwayne, Mityagin, Anton
• Granted Patent: US 10,425,391 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

A method, system, and manufacture for securely broadcasting shared folders from one client device to other client devices and synchronizing the shared folders over a local area network. A first client device, associated with a content management system, generates a secure identifier for a shared folder, using a shared secret key that is associated with the shared folder. The first client device announces the secure identifier over a local area network to other client devices on the local area network including a second client device. The first client device receives a synchronization request for the shared folder from the second client device. After authenticating, using the shared secret key, that the second client device has authorization to access the shared folder, the first client device synchronizes the shared folder with the second client device over the local area network.

Claims

1. A computer-implemented method comprising:

receiving, at a first application associated with a content management system on a first client device and a second application associated with the content management system on at least one second client device, from the content management system, a shared secret key generated at the content management system for a shared folder and a corresponding namespace identifier;

generating, via at least one processor of the first client device, a secure identifier based on the shared secret key and namespace identifier and further based on a cryptographic nonce that is uniquely generated for an announcement message; and

broadcasting, by the first application associated with the content management system on the first client device, the announcement message comprising the secure identifier and the cryptographic nonce to the second application associated with the content management system on the at least one second client device.

2. The computer-implemented method of claim 1, further comprising receiving, at the first client device from the content management system, a folder identifier associated with the shared folder.

3. The computer-implemented method of claim 1, wherein the announcement message is associated with multiple user accounts.

4. The computer-implemented method of claim 1, wherein the broadcast announcement message is transmitted to all devices connected to a local area network that includes the first client device and the at least one second client device.

5. The computer-implemented method of claim 1, wherein the shared secret key comprises a secret string.

6. The computer-implemented method of claim 1, wherein the cryptographic nonce is periodically renewed and never repeated.

7. The computer-implemented method of claim 1, wherein generating the secure identifier is further based on an indication of an expiration time, and the method further comprising:

broadcasting the indication to at least the at least one second client device.

8. The computer-implemented method of claim 1, further comprising:

receiving a synchronization request for the shared folder from the at least one second client device; and

in response to determining that the at least one second client device has authorization to access the shared folder using the shared secret key, synchronizing the shared folder to the second client device over the local area network.

9. A non-transitory computer-readable medium storing computer executable instructions for causing a computer to perform a method comprising:

receiving, at a first application associated with a content management system on a first client device and a second application associated with the content management system on at least one second client device, from the content management system, a shared folder having a folder identifier and a shared secret key generated at the content management system for the shared folder;

receiving, at the first application associated with the content management system on the first client device, a first secure identifier associated with the shared folder from the second application associated with the content management system on the at least one second client device;

generating, at the first application associated with the content management system on first client device, a second secure identifier associated with the shared folder based on the shared secret key and namespace identifier and further based on a cryptographic nonce that is uniquely generated for an announcement message; and

broadcasting, by the first application associated with the content management system on the first client device, the announcement message comprising the second secure identifier and the cryptographic nonce to the second application associated with the content management system on the at least one second client device.

10. The non-transitory computer-readable medium of claim 9, wherein the announcement message is associated with multiple user accounts.

11. The non-transitory computer-readable medium of claim 9, wherein the broadcast announcement message is transmitted to all devices connected to a local area network that includes the first client device and the at least one second client device.

12. The non-transitory computer-readable medium of claim 9, wherein when the first secure identifier matches the second secure identifier, associating the folder identifier with the at least one second client device and wherein associating the folder identifier with the at least one second client device yields an association, the method further comprising storing the association.

13. The non-transitory computer-readable medium of claim 9, wherein generating the second secure identifier is further based on an expiration time received from the at least one second client device, and wherein the folder identifier is associated with the at least one second client device only when the expiration time has not passed.

14. The non-transitory computer-readable medium of claim 9, wherein the second secure identifier is generated further based on a cryptographic nonce received from the second application associated with the content management system on the at least one second client device.

15. The non-transitory computer-readable medium of claim 9, wherein the method further comprises:

sending a synchronization request for the shared folder to the at least one second client device;

establishing a secure connection over the local area network with the at least one second client device using the shared secret key; and

synchronizing the shared folder with the at least one second client device via the secure connection.

16. A manufacture comprising:

a non-transitory computer-readable medium; and

computer-readable instructions, stored on the non-transitory computer-readable medium, that when executed are effective to cause an application associated with a content management system on a computer to;

generate, at a first application associated with the content management system on a first client device, a secure identifier for a shared folder, based on a shared secret key generated at the content management system for the shared folder and further based on a cryptographic nonce that is uniquely generated for an announcement message; and

broadcast by the first application associated with the content management system on the first client device the announcement message comprising the secure identifier and the cryptographic nonce to a second application associated with the content management system on at least one second client device using the announcement message.

17. The manufacture of claim 16, wherein the shared folder is synchronized with the content management system, and wherein the first client device and the at least one second client device are associated with the content management system.

18. The manufacture of claim 16, wherein the computer-readable instructions, wherein the broadcast announcement message is transmitted to all devices connected to a local area network that includes the first client device and the at least one second client device.

19. The manufacture of claim 16, wherein the computer-readable instructions are effective to further cause the computer to authenticate, using the shared secret key, the at least one second client device for access to the shared folder.

20. The manufacture of claim 16, wherein the announcement message is associated with multiple user accounts.