Co-managing links with a link platform and partner service

Patent metadata

Field	Value
Publication number	US-11609770-B2
Application number	US-202117360549-A
Country	US
Kind code	B2
Filing date	Jun 28, 2021
Priority date	Jun 28, 2021
Publication date	Mar 21, 2023
Grant date	Mar 21, 2023

Abstract

The present technology pertains to a link service that can create, maintain, and service links to objects on behalf of a content management system or other services. The link service can share administration of links with other services when desired or can even allow other services to issue the link and manage the object that is the subject of the link while providing other functions to support the link. Additionally, link service can interface with a file system that can support links as actors in the file system, whereby greater control and flexibility in supporting links is provided. Link service can also accommodate servicing and management of links issued by legacy services, where the legacy services have unique link logic that should still be utilized to maintain a consistent user experience.

First claim

What is claimed is:

1. A method comprising:
receiving, by a link service, and from a partner service, a second request to provide access to an object referred to by a co-managed link, wherein:
the second request is a result of a first request, received by the partner service, pertaining to the object,
the first request results from a link caller calling a partner service link that has been determined by the partner service as a valid link, and
the partner service link has been mapped, via the first request and by the partner service, to the co-managed link;

performing, by the link service, link servicing functions including validating the co-managed link, and link logging; and
after performing the link servicing functions, sending, by the link service to the partner service, a file system access object pointing to a file system containing the object, the file system access object including an authorization token, an identification of an authorized entity, and an object ID.

2. The method of claim 1 , wherein the second request to provide access to the object from the partner service occurs after the partner service determines that the link caller is authorized to access the object, whereby the partner service and the link service both make their own access determination.

3. The method of claim 2 , wherein the identification of the authorized entity is a s_ID corresponding to the co-managed link.

4. The method of claim 1 , further comprising:
in response to receiving the second request from the partner service, creating the file system access object pointing to the file system.

5. The method of claim 1 , wherein the file system access object includes the authorization token having a time-to-live to limit a time in which the file system access object remains valid.

6. The method of claim 1 , further comprising:
prior to the file system sending the object to the partner service, sending an access level request associated with the co-managed link to the link service;
determining, by the link service, an access level associated with the co-managed link; and
sending, by the link service to the file system, the access level associated with the co-managed link.

7. The method of claim 1 , further comprising:
determining, by the file system, whether the file system access object identifies a first sID that is granted access in access permissions for the object in the file system; and
when the first sID is granted access to the object, sending the object to the partner service consistent with the access permissions for the object.

8. The method of claim 7 , further comprising:
determining that the link caller has a user account at the file system; and
including a second sID for the user account in the authorization token in addition to a link_sID.

9. The method of claim 1 , wherein the second request to provide access to the object referred to by the co-managed link identifies the link caller requesting the object from the partner service.

10. The method of claim 1 , further comprising:
receiving, by an API of the link service, from the partner service, an access level change request, wherein the access level change request includes a change in at least one access parameter for the object, the change in the at least one access parameter to be applied to the co-managed link.

11. A non-transitory computer readable medium comprising instructions, wherein the instructions, when executed by a computing system, cause the computing system to:
receive, by a link service, and from a partner service, a second request to provide access to an object referred to by a co-managed link, wherein:
the second request is a result of a first request, received by the partner service, pertaining to the object,
the first request results from a link caller calling a partner service link that has been determined by the partner service as a valid link, and
the partner service link has been mapped, via the first request and by the partner service, to the co-managed link;

perform, by the link service, link servicing functions including validating the co-managed link, and link logging; and
after performing the link servicing functions, send, by the link service to the partner service, a file system access object pointing to a file system containing the object, the file system access object including an authorization token, an identification of an authorized entity, and an object ID.

12. The non-transitory computer readable medium of claim 11 , wherein the second request to provide access to the object from the partner service occurs after the partner service determines that the link caller is authorized to access the object, whereby the partner service and the link service both make their own access determination.

13. The non-transitory computer readable medium of claim 11 , further comprising instructions that, when executed by the computing system, cause the computing system to:
determine, by the file system, whether the file system access object identifies a sID that is granted access in access permissions for the object in the file system; and
when the sID is granted access to the object, send the object to the partner service consistent with the access permissions for the object.

14. The non-transitory computer readable medium of claim 11 , wherein the second request to provide access to the object referred to by the co-managed link identifies the link caller requesting the object from the partner service.

15. The non-transitory computer readable medium of claim 11 , further comprising instructions that, when executed by the computing system, cause the computing system to:
receive, by an API of the link service, from the partner service, an access level change request, wherein the access level change request includes a change in at least one access parameter for the object, the change in the at least one access parameter to be applied to the co-managed link.

16. A link service system for co-managing a link with a partner service, comprising:
a storage storing instructions; and
a processor configured to execute the instructions and cause the link service system to:
receive a second request to provide access to an object referred to by a co-managed link from a partner service, wherein:
the second request is a result of a first request, received by the partner service, pertaining to the object,
the first request results from a link caller calling a partner service link that has been determined by the partner service as a valid link, and
the partner service link has been mapped, via the first request and by the partner service, to the co-managed link;

perform, by the link service, link servicing functions including validating the co-managed link, and link logging; and
after performing the link servicing functions, send, to the partner service, a file system access object pointing to a file system containing the object, the file system access object including an authorization token, an identification of an authorized entity, and an object ID.

17. The link service system of claim 16 , wherein the second request to provide access to the object from the partner service occurs after the partner service determines that the link caller is authorized to access the object, whereby the partner service and the link service both make their own access determination.

18. The link service system of claim 17 , wherein the identification of the authorized entity is a s_ID corresponding to the co-managed link.

19. The link service system of claim

Assignees

• Dropbox Inc

Inventors

• Passey Aaron
• Wang Fangzhou
• Cunningham Eric
• Ausburn Royce
• Larson Nicholas
• Wetterau David
• Ho William
• Ho Harrison

Classifications

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06F9/44521 Primary

  Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title