Traversal rights

Patent metadata

Field	Value
Publication number	US-10929426-B2
Application number	US-201715857784-A
Country	US
Kind code	B2
Filing date	Dec 29, 2017
Priority date	Dec 28, 2017
Publication date	Feb 23, 2021
Grant date	Feb 23, 2021

Abstract

The present technology pertains to a organization directory hosted by a synchronized content management system. The corporate directory can provide access to user accounts for all members of the organization to all content items in the organization directory on the respective file systems of the members' client devices. Members can reach any content item at the same path as other members relative to the organization directory root on their respective client device. In some embodiments novel access permissions are granted to maintain path consistency.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions stored thereon, when executed the instructions are effective to cause a content management system to:
provide at least read access to a user account for a folder contained within a superordinate folder to which the user account does not have access due to an access policy for the superordinate folder;
determine that the user account is a member of an organization directory in which the superordinate folder is contained and has at least read access rights to the folder contained within the superordinate folder to which the user account does not have access rights to; and
in response to the determination that the user account is a member of the organization directory and has at least read access rights to the folder, automatically grant a traversal right to the user account for the superordinate folder, whereby the user account can navigate through the superordinate folder in a file explorer user interface to reach the folder to which the user account has been provided at least read access, wherein the superordinate folder further comprises other content items that are visible to another user account while excluded from being shown to the user account.

2. The non-transitory computer readable medium of claim 1 , comprising instructions to cause the content management system to:
detect that the folder has been mounted and that the user account has at least read access to the folder;
determine that a path to the folder includes the superordinate folder to which the user account does not have access; and
record a path to the superordinate folder to which the user account does not have access and the path to the folder in a traversal rights dictionary.

3. The non-transitory computer readable medium of claim 2 , comprising instructions to cause the content management system to:
communicate with a client device having access to the user account to synchronize the folder; and
send the folder and all content items within the folder to the client device, and send information regarding folders in the path to the folder.

4. The non-transitory computer readable medium of claim 3 , comprising instructions to cause the content management system to:
in addition to the sending of the folder and the information regarding the folders in the path, exclude any content items within the superordinate folder other than any folders identified in the path to the folder.

5. The non-transitory computer readable medium of claim 4 , comprising instructions to cause the content management system to:
send a cursor to the client device, the cursor including a record of the user account's at least read access to the folder, and including the path recorded in the traversal rights dictionary.

6. The non-transitory computer readable medium of claim 5 , comprising instructions to cause the content management system to:
receive a request to synchronize the folder, the request including the cursor; using the cursor to confirm the user account's at least read access to the folder, and the user account's traversal rights to the path included in the cursor; and
synchronize the folder.

7. The non-transitory computer readable medium of claim 6 , comprising instructions to cause the content management system to:
remove the at least read access from the user account for the folder contained within the superordinate folder to which the user account does not have access;
remove the path recorded in the traversal rights dictionary;
send an instruction to the client device to delete the folder, and any folders in the path to the folder to which the user account does not have access; and
send a second cursor to the client device without the record referencing the folder.

8. The non-transitory computer readable medium of claim 1 wherein the instructions to provide at least read access to the user account for the folder contained within the superordinate folder to which the user account does not have access further includes instructions that are effective to cause the content management system to:
associate the user account with the folder in a restrictive access control list;
wherein the restrictive access control list overrides the access policy for the superordinate folder including the folder to prohibit at least the user account having access to the superordinate folder from accessing the folder and from seeing an existence of the folder except for the user account that is included in the restrictive access control list in association with the folder, thereby providing the at least read access to the user account for the folder.

9. A method comprising:
detecting that a folder has been mounted and that a user account is a member of an organization directory in which a superordinate folder is contained and has at least read access to the folder;
determining that a path to the folder includes the superordinate folder that restricts access by the user account; and
in response to the determination that the user account is a member of the organization directory and has at least read access rights to the folder, automatically recording a path to the superordinate folder to which the user account does not have access and the path to the folder in a traversal rights dictionary, whereby the user account can navigate through the superordinate folder in a file explorer user interface to reach the folder to which the user account has been provided at least read access, wherein the superordinate folder further comprises other content items that are visible to another user account while not shown to the user account.

10. The method of claim 9 comprising:
sending an instruction to a client device that is authorized to access the user account to synchronize the folder;
sending the folder and all content items within the folder to the client device; and
sending information regarding folders in the path to the folder.

11. The method of claim 10 , comprising:
excluding any content items within the superordinate folder other than any folders identified in the path to the folder.

12. The method of claim 11 , comprising:
sending a cursor to the client device, the cursor including a record of the user account's at least read access to the folder, and including the path recorded in the traversal rights dictionary.

13. The method of claim 12 , comprising:
receiving a request to synchronize the folder, the request including the cursor;

confirming the user account's at least read access to the folder using the record in the cursor, and the user account's traversal rights to the path included in the cursor; and
synchronizing the folder.

14. The method of claim 13 , comprising:
removing the at least read access from the user account for the folder contained within the superordinate folder to which the user account does not have access;
removing the path recorded in the traversal rights dictionary;
sending an instruction to the client device to delete the folder, and any folders in the path to the folder to which the user account does not have access; and
sending a second cursor to the client device without the record referencing the folder.

15. A content management system comprising:
at least one processor; and
at least one memory having instructions stored thereon, that when executed the instructions are effective to cause the at least one processor to:
provide at least read access to a user account for a folder contained within a superordinate folder to which the user account does not have access due to an access policy for the superordinate

Assignees

• Dropbox Inc

Inventors

• Kleinpeter Thomas
• Xu Tony
• Sydell Alex
• Bunger Nils
• Jau Sam
• Staley Aaron
• Lin Sara

Classifications

• G06F16/27 Primary

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F16/11 Primary

  File system administration, e.g. details of archiving or snapshots (error detection or correction of the data by redundancy in operations G06F11/14) · CPC title

• H04L67/01

  Protocols · CPC title

• G06F16/16

  File or folder operations, e.g. details of user interfaces specifically adapted to file systems · CPC title

• G06F16/1734

  Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs · CPC title