Server-side rendering password protected documents

Patent metadata

Field	Value
Publication number	US-12367301-B2
Application number	US-202117559407-A
Country	US
Kind code	B2
Filing date	Dec 22, 2021
Priority date	Jan 10, 2018
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

In some examples, a system for server-side rendering of password-protected files can receive, from a client device, a request to view a file on the system, determine that the file should be converted to a different format prior to presentation at the client device, and determine that the file is a password-protected file. The system can send a response to the client device indicating the file is a password-protected file. In response to receiving the password from the client device, the system can generate, based on the password, a preview of the password-protected file including at least a portion of the password-protected file rendered in the different format. After generating the preview, the system can store an encrypted copy of the preview in storage for future requests, and send the preview to the client device.

First claim

What is claimed is:

1. A method for rendering password-protected files comprising:
receiving, through a web interface service of a content management system, from a client application at a client device, an initial request to view a password protected file on the content management system;
converting, based on one or more conversion flow rules, one or more intermediate files in a first format associated with the password protected file to a final password protected file in a second format associated with the client application, wherein the first format is different from the second format;
storing an encrypted preview of the final password protected file and an encrypted version of the final password protected file in the second format, wherein the encrypted preview represents a portion of the final password protected file;
retrieving, by the content management system in a first instance, the encrypted preview stored in the content management system;
decrypting the encrypted preview of the final password protected file using a password that is stored or a token that is stored;
sending, through the web interface service of the content management system to the client application at the client device in response to the initial request, a decrypted copy of the encrypted preview;
retrieving, by the content management system in a second instance, the encrypted version of the final password protected file in the second format;
decrypting the encrypted version of the final password protected file using the password that is stored or the token that is stored; and
sending, through the web interface service of the content management system to the client application at the client device, a decrypted version of the final password protected file.

2. The method of claim 1 , further comprising determining, by the content management system, that the client application associated with the initial request is different from a native application associated with the password protected file.

3. The method of claim 1 , wherein decrypting the encrypted preview using the token comprises:
extracting a second password from the token;
accessing the encrypted preview with the second password; and
converting the encrypted preview from an original format to a different format to yield the decrypted copy of the encrypted preview.

4. The method of claim 1 , wherein the content management system stores the final password protected file in the second format.

5. The method of claim 1 , wherein the retrieving the encrypted preview further comprises:
performing a cache lookup, based on identifying information used to encrypt the encrypted preview, to determine that the encrypted preview of the final password protected file was previously generated;
extracting the encrypted preview of the final password protected file that was previously generated based on the cache lookup; and
providing the encrypted preview of the final password protected file that was previously generated to the web interface service.

6. The method of claim 5 , wherein the identifying information includes at least one of a second password associated with the token, the initial request, a key based on the initial request, and a data structure based on the initial request.

7. The method of claim 1 , further comprising:
receiving, a second token;
storing the second token; and
using the second token to decrypt the encrypted preview of the final password protected file.

8. The method of claim 1 , further comprising: generating a tree structure for the initial request; and
using the tree structure as an initial request specific password.

9. The method of claim 1 , further comprising:
receiving a notification of a password error in response to retrieving the encrypted preview in the first instance and before decrypting the encrypted preview;
attempting to decrypt the encrypted preview, wherein the password error indicates that the initial request includes an improper or missing initial password;
based on the password error, determining that the retrieved encrypted preview of the password protected file is encrypted and failed to decrypt using the improper or missing initial password, wherein the password error indicates that an encryption key is needed; and
storing the password or the token that is then used for decrypting the encrypted preview.

10. A non-transitory computer-readable medium comprising instructions stored therein which, when executed by one or more processors, cause the one or more processors to:
receive, through a web interface service of a content management system, from a client application at a client device, an initial request to view a password protected file on the content management system;
convert, based on one or more conversion flow rules, one or more intermediate files in a first format associated with the password protected file to a final password protected file in a second format associated with the client application, wherein the first format is different from the second format;
store an encrypted preview of the final password protected file and an encrypted version of the final password protected file in the second format, wherein the encrypted preview represents a portion of the final password protected file;
retrieve, by the content management system in a first instance, the encrypted preview stored in the content management system;
decrypt the encrypted preview of the final password protected file using a password that is stored or a token that is stored;
send, through the web interface service of the content management system to the client application at the client device in response to the initial request, a decrypted copy of the encrypted preview;
retrieve, by the content management system in a second instance, the encrypted version of the final password protected file in the second format;
decrypt the encrypted version of the final password protected file using the password that is stored or the token that is stored; and
send, through the web interface service of the content management system to the client application at the client device, a decrypted version of the final password protected file.

11. The non-transitory computer-readable medium of claim of claim 10 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to:
determine, by the content management system, that the client application associated with the initial request is different from a native application associated with the password protected file.

12. The non-transitory computer-readable medium of claim 10 , wherein decrypting the encrypted preview includes additional instructions which, when executed by the one or more processors, cause the one or more processors to:
extract a second password from the token;
access the encrypted preview with the second password; and
convert the encrypted preview from an original format to a different format to yield the decrypted copy of the encrypted preview.

13. The non-transitory computer-readable medium of claim of claim 10 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to:
perform a cache lookup, based on identifying information used to encrypt the encrypted preview, to determine that the encrypted preview of the final password protected file was previously generated;
extract the encrypted preview of the final password protected file that was previously generated based on the cache lookup; and
provide the encrypted preview of the final password protected file that was previously generated to the web interf

Assignees

• Dropbox Inc

Inventors

• Acharya Aditya
• Zhu Jingsi
• Vente Sarah
• Macartney Ian
• Unal Ahmet Emre

Classifications

• G06F40/106 Primary

  Display of layout of documents; Previewing · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• G06F16/1794

  Details of file format conversion · CPC title

• G06F21/31

  User authentication · CPC title