Authentication state-based permission model for file storage systems

Abstract

A system controls access to data stored in a cloud-based storage service. A first request is received for accessing data stored at the cloud-based storage service, the data being associated with a user account. The first request is authenticated based on a username and password associated with the user account. A second request is received for a file stored in an area associated with an enhanced authentication protocol. The enhanced authentication protocol is executed to authenticate the second request. In response to authenticating the second request, a license is granted to a temporary strong authentication state. The license is for accessing the file stored in the area associated with the enhanced authentication protocol. In response to a failure to authenticate the second request, access to the file is denied while access to files stored in other areas associated with the user account is allowed.

Description

Background Art

[0001] Distributed storage systems (e.g., cloud storage systems) typically use server computers and storage devices connected to the Internet and / or other types of networks to store computer data and software applications. Devices can connect to servers via a web browser or a dedicated distributed storage application, for example, to retrieve data, upload data, and / or run software applications. This arrangement can be beneficial for computing devices with limited storage, such as mobile computing devices, which may benefit from the large storage capacity and higher performance of the server. This arrangement can also be beneficial in generally providing a centralized location for storing a user's data that can be accessed by multiple devices, regardless of their location.

[0002] Distributed storage has become a readily available Internet service (e.g., OneDrive, Dropbox, Google Docs, and Amazon Cloud Drive storage services). Distributed storage enables users to upload files to a server and distribute those files to multiple devices based on a secure permission system that allows access to the centrally stored data set. Specifically, a file can be created on a user's computer, the file can be uploaded to a server, and the server has instructions provided by the user on where to send the file or how to access the file.

[0003] In recent years, the use of such cloud-based computing services has increased significantly. Additionally, the amount of data created and stored by users has increased significantly. While much of this data may not include sensitive or confidential information, users often include personal information in at least some of the data they store. Such data may include bank statements, account information, social security numbers, and other personal information.

[0004] Given the total amount of data that users typically store in their data files, it can be challenging to ensure that users can securely access such personal information. In addition, it is cumbersome to apply special security measures to all of their data, or to apply such measures individually to each sensitive data file. This may lead to some inefficiencies because security features must be applied to data that does not require or expect a high level of security procedures, or users must repeatedly comply with such procedures. In many applications, such as Word, Excel, OneNote, Pages, Numbers, Google Docs, and Google Sheets, each application may have its own data file interface, and the implementation of security measures for sensitive documents may require each application to implement security mechanisms. However, applications may not apply security features in a consistent manner. This may cause some problems because applications may not implement security features in an effective manner. In addition, users may need to learn and interact with various security implementation methods. Such limitations may lead to some inefficiencies and less than ideal user experiences. Summary of the invention

[0005] At least some embodiments of the present disclosure relate to providing a secure area in a distributed storage system. In some embodiments, the secure area may be referred to as a vault, which may be a special folder that requires additional authentication measures (e.g., two-step verification) to access content or even view the vault. This folder provides an additional layer of security to files and documents in the event that a user's device or account is compromised. In some embodiments, an additional layer of security may be provided more generally for a class of actions or activities rather than activities bound to a secure storage area, where a vault may be a type of such activity. It should be understood that although the example embodiments described herein refer to a vault, the disclosed principles may be applied to actions or activities bound to an additional layer of security.

[0006] When role-based access control is used, roles are typically associated with a given user rather than the instantaneous authentication state of the user. In a personal cloud file system, after authentication is complete, access rights to files and folders are granted to a security principal (user or group) typically by providing a username and password. In one aspect of the present disclosure, permissions may be granted to a temporary strong authentication state rather than a security principal. The present disclosure provides a way to grant permissions to a folder or file based on a temporary strong authentication state only when a specific type of authentication such as a strong authentication is used. In one embodiment, unless a strong authentication is first performed, a user with a conventional authentication will not be able to view files in a vault and access such files. In one embodiment, permissions may be granted to an action set that is bound to the entire file system but not necessarily to a specific folder / file based on a temporary strong authentication state. A temporary strong authentication state may be required to allow a user to perform a specified action, such as an action that is irreversible or otherwise may have a significant impact.

[0007] The technology disclosed herein provides some improvements to existing systems. For example, when files are stored in remote storage services such as Google Drive, iCloud, or OneDrive, a secure area can be provided, which can be used to selectively store files therein without applying additional security mechanisms to all of the user's files or to select files individually. The technology disclosed herein further improves the interaction between the user and the computer, while providing improvements for processing resources, network resources, and memory resources. For example, users no longer need to manually apply security measures to individual files or open separate security accounts to store sensitive files, resulting in users having to manage multiple storage services and accounts. As disclosed herein, a more simplified way of providing a secure area can reduce unintentional input, and other efficiencies can be improved based on this.

[0008] This Summary is provided to introduce in simplified form a selection of concepts further described below in the Detailed Description. This Summary is not intended to identify key or important features of the claimed subject matter, nor is it intended to be used to assist in determining the scope of the claimed subject matter. For example, the term "techniques" may refer to systems, methods, computer-readable instructions, modules, algorithms, hardware logic, and / or operations as allowed by the context above and the entire document. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The detailed description is described with reference to the accompanying drawings. In the drawings, the leftmost digit of a reference number identifies the drawing in which the reference number first appears. The same reference number indicates similar or identical items in different drawings. References to individual items of a plurality of items may use reference numbers with letters in the alphabetical sequence to refer to each individual item. General references to items may use specific reference numbers without the alphabetical sequence.

[0010] Figure 1 is a block diagram of a system for providing secure zones in a storage network.

[0011] Figure 2 is a block diagram showing further details in a system for providing secure zones in a storage network.

[0012] Figure 3 An example user interface showing security zones in a storage network is illustrated.

[0013] Figure 4 is a flow chart illustrating aspects of a routine for providing secure zones in a storage network.

[0014] Figure 5 is a flow chart illustrating aspects of a routine for providing secure zones in a storage network.

[0015] Figure 6 is a flow chart illustrating aspects of a routine for providing secure zones in a storage network.

[0016] Figure 7 is a flow chart illustrating aspects of a routine for providing secure zones in a storage network.

[0017] Figure 8 is a flow chart illustrating aspects of a routine for providing secure zones in a storage network.

[0018] Fig. 9 is a computer architecture diagram showing an illustrative computer hardware and software architecture for a computing system capable of implementing aspects of the methods and techniques presented herein.

[0019] Fig.10 is a diagram illustrating a distributed computing environment in which aspects of the methods and techniques presented herein can be implemented.

[0020] Fig.11 is a computer architecture diagram illustrating a computing device architecture for a computing device capable of implementing aspects of the methods and techniques presented herein. DETAILED DESCRIPTION

[0021] Many users store and access sensitive documents among their stored data. Such sensitive documents can include passports, social security numbers, and other identity information, as well as financial information such as bank statements and account numbers. Not only do users want to protect such sensitive information and prevent it from falling into the wrong hands, they also typically want such information to be difficult to modify or delete accidentally.

[0022] Existing alternatives require additional password protection for sensitive documents, which may not be integrated with the user's personal cloud. Access rights are usually granted to specific users and authenticated via a simple username and password or other single-factor authentication scheme. The username and password are usually stored locally and remembered by the device. After the user sets up the computer for access, the entire personal cloud is accessible. There is no location in the personal cloud for more sensitive documents that require additional authentication. In various embodiments, a mechanism is provided for a personal cloud-based storage service to provide a secure area to store more sensitive documents and files. Such an area may require users to pass additional authentication measures, such as two-factor authentication (TFA) or multi-factor authentication (MFA) or more general enhanced authentication protocols to access the secure area. Such additional authentication measures may be required above and beyond the username / password combination or other simple authentication that the user needs to provide to access its cloud-based storage service. Similarly, users cannot identify actions or activities that require strong authentication.

[0023] When role-based access control is used, roles are typically associated with a given user rather than the instantaneous authentication state of the user. In a personal cloud file system, after authentication is complete, access rights to files and folders are granted to a security principal (user or group) typically by providing a username and password. In one aspect of the present disclosure, permissions can be granted to a temporary strong authentication state rather than a security principal. The present disclosure provides a way to grant permissions to a folder or file based on a temporary strong authentication state only when a specific type of authentication such as strong authentication is used. In one embodiment, unless a strong authentication is performed first, a user with a conventional authentication will not be able to view files in a vault and access such files. In one embodiment, permissions can be granted to a set of actions that are bound to the entire file system but not necessarily to a specific folder / file based on a temporary strong authentication state. As an example, changing the quota of the entire file system may be such an action, where changing the quota may be bound to a set of operations <view, create, and modify>. Another example may be to empty the recycle bin. A temporary strong authentication state may be required to allow a user to perform a specified action, such as an action that is irreversible or otherwise may have a significant impact.

[0024] On the other hand, the present disclosure provides a way to create a secure portion of a personal cloud file system that requires additional security to access, such as strong authentication. In some embodiments, two-factor authentication (TFA) or multi-factor authentication (MFA) is required to access additional secure folders in the personal cloud file system. The secure portion may be referred to as a vault. The act of providing strong authentication to obtain access to the secure portion may be referred to as unlocking the vault. It should be understood that although reference may be made to "the vault" or "a vault", there may be multiple vaults associated with a user's storage.

[0025] The secure portion can be any part of the user's file structure. Thus, a vault can be a folder or a volume. Folders can be created in a vault, files and folders can be moved into a vault, and existing folders can be converted to a vault. Vaults can also be used to protect other types of data structures. For example, a metadata database storage system can be protected as a vault. Other types of data and file management interfaces can be configured to interface with the vault. In some embodiments, the vault can be managed by a vault storage service, which can provide services that allow various applications to interact with the vault.

[0026] In some embodiments, unless the application is using some form of local encryption, it may be necessary for the application to ensure that vaulted items are not cached on the local storage of the user's device. If the application needs to provide offline access or caching of vault items, the items and their associated metadata may be stored using encryption and may be protected by strong authentication and / or biometric authentication. For applications that track recently used items, vault items may not appear in the recently used list unless the list is filtered based on the current vault lock state, thereby excluding vault items when the vault is locked. Another example may be a search index containing vault item data that may similarly exclude vault items when locked.

[0027] In some embodiments, items in a vault may not be allowed to be shared. For example, the command list for vaulted items may exclude "Share". For the root vault folder, "Download" and "Copy" may also be excluded. If shared items are moved into a vault, the sharing functionality may be removed from those items. Sharing commands (create sharing link, send sharing invitation, add permissions) may fail for items in a vault. In order to share items, users may need to move them out of the vault.

[0028] In some embodiments, a warning may be provided before a vault item is moved out of the vault or deleted. If a vault item is deleted, it may be placed in a recycle bin. A deleted vault item may retain its vault aspects while in the recycle bin. When enumerating items in the recycle bin while the vault is locked, the vault item may be excluded from the results. In some embodiments, the vault item may be excluded from the search results even if the vault is unlocked.

[0029] The amount of data or the number of objects and files that can be stored in a vault may be limited based on a service agreement with the user or whether the user has subscribed to the vault storage service.

[0030] In one embodiment, access to the vault may be time-limited. After a predetermined time, the vault may be automatically locked, requiring re-authentication to open. If the vault is not locked and unused for a specified amount of time, the vault may be automatically locked. This may be referred to as vault auto-lock. The amount of time may be variable. In one embodiment, a 20 minute time period may be implemented.

[0031] In some embodiments, a vault token may be provided that can unlock the vault for a long period of time. The long-term unlock may allow access to the vault for a longer period of time, such as 90 days. In some embodiments, the long-term unlock may be used across multiple sessions. For example, an application may use multi-factor authentication to implement a short-term unlock, such as 20 minutes, and extend it based on an additional authorization method, such as using local biometrics. The vault token may be renewed after the unlock period.

[0032] In various embodiments, vault permissions can be per device or per specific endpoint. Device independence can be provided even without multi-factor authentication independence. For example, when a vault is unlocked, only the device that initiated the unlock can access the vault. Client access can be client and session specific. Different clients or the same client with different sessions may need to be authenticated separately.

[0033] Before accessing files stored in a vault, an application may be required to unlock the vault. In one embodiment, an unlock API may be implemented that requires a strong authentication token, which the application may obtain before calling the unlock API. After a successful unlock, the application may receive a vault token with a longer validity period, or the current session may be unlocked during the automatic lock period. After the unlock operation, the application may discard the strong authentication token. The application may access the vault by using the same session (e.g., the session ID may be part of a regular authentication token) or by providing a vault token.

[0034] MFA can be triggered by specifying an authentication policy. Authorization can be configured so that the entire content of a user account does not have to opt in to MFA. Instead, MFA can be requested for specific scenarios.

[0035] When any operation is requested on an item in a vault, an authorization process may be triggered. The assigned role may be obtained based on the storage context information, and the item may be included in an access control list (ACL). The required role may be obtained based on the role definition configuration associated with the operation on the item, such as the session owner. The assigned role may be compared to the required role, and based on the result, access rights may be granted or denied. If access rights are denied, an error may be provided to the client.

[0036] If the vault is to be unlocked, an unlock page may be accessed and the resource ID of the vault may be passed. The resource ID may be a unique identifier for an item in the storage service. In one embodiment, a session ID from a ticket may be used as the session ID. In another embodiment, a hash including a user identifier (e.g., PUTD) and another value may be used. In one embodiment, the time when the user last logged in by entering a password may be used. An unlock page may be accessed and the MFA process may be initiated.

[0037] In some embodiments, items inside a vault may have vault aspects. The aspects may indicate vault-specific information, such as whether the item is in the vault, whether the vault is locked, or an expiration date.

[0038] Once unlocked, applications can treat the vault as part of a single file system without having to implement their own protection scheme. Client applications can enumerate files by receiving information about changes in the vault and syncing the files locally on the device. For example, the vault may have been created on a different endpoint and may need to be synchronized. Otherwise, the vault may have already been created on this endpoint. In either case, the default initial state is locked.

[0039] Vaults can be extended to mobile and file sync clients. File sync clients can be configured to maintain the security of any content synced with the vault's content, including maintaining secure access to locally stored content. Sync or mobile clients can pass the vault token as a new header on all subsequent calls that might otherwise prevent them from accessing the vault. If the vault token matches the item's ACL, access can be granted.

[0040] In some embodiments, when vault access is initiated on a mobile device, the mobile device may be able to maintain access to the vault based on its own authentication methods, thereby allowing the use of mobile device methods to replace service-side authentication requirements, such as using biometric input that can be used to authenticate the user. Based on continued authentication using these methods, the mobile device can continue to synchronize vault content.

[0041] Each endpoint (e.g., website, mobile client, and sync client) may be able to automatically provision a vault (i.e., trigger the creation of a vault special folder). In one embodiment, an XML file may be used to control settings. The file may be read and parsed at runtime to retrieve the settings defined in the file. Role definitions may define access rights to each method and property based on roles. The session owner may be a role assigned and granted when the vault folder is unlocked. The session owner role may be required to create a vault sub-item. In one embodiment, items stored in a vault may be arranged in a hierarchy, and sub-items may inherit policies and behaviors from their parents. Items in a hierarchy that define policies and behaviors that children may inherit may be referred to as components.

[0042] When a user clicks on a vault, client-side logic can be invoked, opening an embedded browser window configured to prompt the user to perform strong authentication, such as MFA. Mobile clients can support client-specific lock / unlock while maintaining server access. Sync clients can rely on server-side lock / unlock. Locking a vault can cause files associated with the vault to be deleted when a subsequent call is made to identify changes.

[0043] In some embodiments, the vault storage service may relax the requirements for adding data to a vault, but require a higher degree of authentication to view, edit, move, or delete data in the vault.

[0044] In the following examples, the additional authentication measure required to access the vault is multi-factor authentication (MFA), but it should be understood that other authentication measures can be implemented. In one embodiment, when a user successfully logs in using MFA, an access token can be issued and associated with the current session. In one embodiment, the token can be associated with the user's ID and the partition's ID. The current session ID can be added to an access control list (ACL). Access rights to the vault are then available and a role can be assigned to the user. The role can be used in part to access the vault contents. In some embodiments, access to the vault can be bound to a session on a specific device via an available device ID.

[0045] If the app chooses to access using a regular token that includes a session ID after the vault is unlocked, such access can be a short-term unlock. The vault can lock the session after the lock timeout, and the app can periodically extend the unlock to continue accessing the vault. If the app does not perform any vault operations for the lock timeout, the session unlock can expire and a new unlock may be required. If the user logs out and then logs back in, a new session can be created and a new unlock may be required.

[0046] In some embodiments, a vault may be implemented as a special folder that may be configured with a role definition and a vault folder root. The role definition configuration for a vault may include a vault folder root as a role definition for a top-level vault folder. A vault may be created using a pre-configured template in which the details of creation are abstracted.

[0047] The current disclosure describes granting permissions primarily to temporarily authenticated sessions. By granting permissions, the Vault Storage Service can also maintain a record of who currently has the vault open. The Vault Storage Service can also revoke access permissions by locking the vault based on an automatic lock timeout or other factors. By maintaining locking control, the Vault Storage Service can enforce a consistent level of security by not relying on users to adhere to security practices. The Vault Storage Service can maintain locking control by revoking permissions, such as by controlling ACLs. In some embodiments, revocation of access permissions to a vault can cause any locally saved copies of the stored documents to be deleted from the device.

[0048] Based on inheritance from the original session, actions initiated on the stored documents can be allowed, thereby allowing additional sessions to be separated from the original session. For example, MFA can be performed initially to authenticate the session, and further configuration can be initiated to provide a more customized access level. For example, a secondary or sub-token associated with a secondary policy can be generated for different contexts. The secondary or sub-token can be based in part on the state of the first token. In some embodiments, the additional session can be detached. The additional session can be associated with the original session, where the original session can affect the derived session in some way. For example, the session lifecycle of the secondary session can be updated by refreshing the lifecycle of the original session. Therefore, the secondary or sub-token policy can be detached from or derived from the original token, and the lifecycle of the secondary or sub-token can be detached from or bound to the original token.

[0049] In some embodiments, the file restore function can be used to restore the vault to a previous point in time. If the user has a vault, accessing the file restore function may require unlocking the vault. The API associated with the file restore function may require the vault to be unlocked.

[0050] In some embodiments, although the file recovery function can undo the action related to the items in the vault, the file recovery function may not undo the creation or deletion (disable) of the vault itself. In one embodiment, during file recovery, creating and deleting a vault root folder may be considered as irreversible.

[0051] When granting time-limited permissions to a user using MFA as described herein, the session time limit may be reached even if the user is editing a document. If the document becomes locked before the document can be saved and the application is closed, unexpected results or failures may occur. Additionally, some applications may not be configured to interact with the vault functionality and may not be able to handle the sudden loss of access to files in the vault.

[0052] In some embodiments, if it is determined that the user has a vault file open and is actively editing the file, the automatic lock can be postponed. In some embodiments, a heuristic-based decision can be made as to when to lock the vault. The decision can also be based on multiple factors, such as the level and type of user activity, the length of time since the TFA, etc. By providing an area accessible during a limited time via strong authentication, the user can continue to access files in the vault during that time limit without having to authenticate for each operation.

[0053] In another aspect of the present disclosure, a session may be granted permission for the purpose of editing a specified document to ensure that the user can complete editing the document even after the temporary vault permission expires. In this way, while the original user session may time out, the session used to edit the document will not. In some embodiments, the application may be notified that the vault is locked and that open documents stored in the vault should be prepared for closing. Thus, the application may make its own efforts to extend the token. If any vault items are in use, the application may automatically extend the vault unlock. The application may also warn the user when the vault unlock is about to expire due to inactivity and provide the option to extend the vault unlock. The application may also provide the option to manually lock the vault and thereby revoke an existing vault unlock.

[0054] Extended or longer-lived tokens allow for customization of user actions and experiences for situations with different security levels. Once MFA is performed and vault access is granted, the vault can be configured to grant further authorizations with different security levels, such as launching a browser session, launching an edit session for a file, unlocking a mobile device, etc. Entries can be included in the vault ACL to allow these secondary actions.

[0055] In some embodiments, a new session may be authorized for the sole purpose of editing a specified document. Although the vault may time out and lock the original session, the session for editing the document may not be affected. The permissions granted may be limited to the document being edited. In some embodiments, when the vault is unlocked, the session may be granted access only to the specified file or document.

[0056] In some embodiments, the vault storage service can enable compatibility between operating environments that are configured to interact with the vault mechanism and operating environments that are not configured to interact with the vault mechanism. The operating environment can obtain tokens on behalf of legacy applications that are not configured to interact with the vault. The operating environment can proxy vault token extension and management even though the legacy application is not specifically configured to handle interactions with the vault.

[0057] Over time, parts of a cloud file system may implement different functionality. However, older applications may not be able to interact with new functionality or even stop working after the cloud file system is updated. For example, in a cloud file system where specific folders have special functionality or constraints, such as the vault with special MFA requirements disclosed in this article, some existing applications may behave incorrectly, fail to read folders or files, or stop working completely as special folders with new functionality are introduced. In addition, such applications may incorrectly process information in the vault and pose security risks. Typical solutions require the client and server to agree on specific functionality based on version levels and interface definitions. This would require the client and server to agree on version levels and functionality in advance.

[0058] In another aspect of the present disclosure, an application may be required to add a special header in order to be provided access to the vault. Applications that do not provide the header may not be allowed to access the vault. Applications that provide the special header may also need to provide a strong authentication token to unlock the vault before accessing any vault content. A strong authentication token may be requested from an account management service and passed to the vault storage service via an application programming interface (API). In some embodiments, this may be required for each unlock request, even if the user has logged in using two-factor authentication. For example, an application may pass an opt-in header in an API request to the vault storage service to indicate that the vault is known, and the application may be provided with information about the vault before the vault is unlocked, such as an indication of its location in the file system. If the calling application does not provide an opt-in header, the vault may be hidden from the application even if an authorization token is provided. Applications that provide an opt-in header may be referred to as vault-aware applications. In this way, older applications can continue to function unchanged, while new parts are hidden, so no action from the application is required.

[0059] In one embodiment, a vault-enabled application may include a "prefer" request header with each request related to a vault. For example, Prefer: Include-Feature=vault. Applications that do not include this header may not see the vaulted folder or any items under it.

[0060] Alternative implementations may utilize hidden flags or system flags in the file system to address this issue. However, such approaches may reveal information about the presence of hidden objects. The described embodiments allow customization on a per-application basis without having to store state information for each application or otherwise store state on each device or customization at a per-device level, which requires extensive storage semantics. The described embodiments also allow flexibility based on the context of the call. The described embodiments also allow compatibility to be confirmed without tracking version levels.

[0061] In cloud-based file systems where certain folders have special capabilities or restrictions (e.g., a vault with special MFA requirements as described herein), the vault is available when it is unlocked and unavailable when it is locked. When a vault is locked, folders and files within the vault may appear to disappear. The local file visualization system must determine whether to remove from the local file system or otherwise distinguish between files that are hidden due to vault lock or files that no longer appear due to actual deletion.

[0062] In another aspect of the present disclosure, files and folders that are locked in the vault and do not currently have an active and authorized session can be displayed as being locked by the file system rather than deleting the locked items. In some embodiments, the list of items in the locked area may not be visible otherwise, so the existence of such items is not allowed to be exposed. In some scenarios, this may be desirable in order to provide the minimum information required to provide status for the locked items without exposing specific information related to the items.

[0063] In one embodiment, a tombstone may be used to identify vaulted and locked items. Many clients provide support tombstones for soft and hard deleted items. The tombstone indicates to the client that the item should be displayed as deleted and / or should be hidden. In order to indicate to vault-aware clients that an item must be deleted from disk rather than moved to the Recycle Bin, a "locked" attribute may be included in the tombstone. Vault-aware clients may use this attribute to determine that a file should be deleted locally. The additional attribute may be completely transparent to legacy clients.

[0064] Clients that are not configured to interact with the vault can be notified that a locked item is no longer available by using a tablet to indicate to the client that the item is no longer visible on the client and should be deleted. The client can determine what local actions to take based on this information. This can allow applications that are not configured to interact with the stored items to implement actions that are appropriate or otherwise consistent with the locking of the stored items. Thus, when the vault is locked, the client can delete the stored items locally.

[0065] At least two types of authorization can be implemented. Fully trusted first-party authorization can be used by sync clients and mobile clients. Delegated authorization can be used to obtain access tokens that do not require consent. In order to access a user's vault stored in the cloud, MFA must succeed. In order to perform any create, read, update, and delete operations on files in the vault, the client must have an active authorization that has been MFAed within the timeout period.

[0066] Figure 1 A system 100 is illustrated that enables a user to create and access a vault. In one illustrative example, the system 100 includes at least two computing devices: a client computing device 106 and a server computer that operates a remote storage service 110 (also referred to herein as "remote service 110") and a vault storage service 136 (also referred to herein as "vault service 136"). The system 100 may also include one or more networks 108 for enabling computing devices to communicate. This example is provided for illustrative purposes and should not be construed as limiting. It will be appreciated that the system 100 may include any number of computers, including multiple client computers that simultaneously edit a single file stored at a client computer and one or more server computers that facilitate the remote storage service 110.

[0067] Remote services 110 and vault storage services 136 may be in the form of a personal computer, a server farm, a large computer system, or any other computing system having components for processing, coordinating, collecting, storing, and / or transferring data between one or more computing devices. Examples of such services include storage services provided by OneDrive, Dropbox, Microsoft, Amazon, Apple, Google, etc.

[0068] The service 110 may also include one or more storage units 151, also referred to herein as "remote storage 151". The remote storage 151 may include a storage structure that defines a plurality of directory locations. For example, the remote storage 151 may include a directory structure having a plurality of folders (e.g., locations (A to G)). The folders may have a hierarchy, such as Figure 1 As shown, each folder can store one or more files and / or folders.

[0069] The client computing device 106 may have any suitable form factor, such as a phone, laptop, desktop computer, tablet computer, etc. The client computing device 106 may include a productivity application 141, a synchronization application 142, a client module 143, and a local storage 150. The client module 143 may provide functionality for performing aspects of the operations disclosed herein, which may cooperate with the vault storage service 136.

[0070] Productivity application 141 provides functionality for enabling a user to edit content 131 of vault file 120. For example, productivity application 141 may include a word processing application that edits text and images within a document. In other examples, productivity application 141 may include a spreadsheet application, a presentation application, a drawing application, or any other suitable application for editing content 131 of vault file 120. The content of a vault file may include text data, image data, video data, markup language, or any other format of data that may define ideas, objects, descriptions, images, preferences, etc. In some configurations, productivity application 141 may display a graphical user interface that displays an authoring pane 191 for displaying content 131 of vault file 120.

[0071] The synchronization application 142 manages files and folders stored on the client computing device 106 and synchronizes the files and folders with the remote storage service 110. The synchronization application 142 manages various aspects of the namespace of the client computing device 106. For the purpose of illustration, the topological namespace modification of the file includes the modification of the file name and / or the modification of the file location. The file can be moved from the starting location to the target location. Renaming a file and / or moving a file to the target location is also referred to as modifying the namespace topology of the file in this article. The synchronization application 142 can maintain a database for the files stored on the client computing device 106. The database can include multiple file attributes, including file names and directory locations, which can be used to coordinate file synchronization with the service 110.

[0072] Vault storage service 136 and synchronization application 142 can communicate with each other to coordinate the state of the vaulted file. For example, vault storage service 136 can lock a file. While a file is locked, vault storage service 136 can prevent synchronization application 142 from seeing the file or applying any changes to the file. Productivity application 141 can also send a request to vault storage service 136 to access vault file 121, which can have a local copy 120. Synchronization application 142 can also provide information about the vaulted file, such as a machine identifier indicating the computer on which the edits were made, and other data indicating the time when the file was last synchronized with vault storage service 136. Such information can enable productivity application 141 to cooperate with vault storage service 136.

[0073] The local storage 150 may include a structure that defines multiple file locations. For example, the local storage 150 may include a directory structure with multiple folders (A to D). The folders may have a hierarchy, such as Figure 1 As shown, each folder can be used to store one or more files. For the purpose of illustration, local storage 150 includes five (5) valid folders (A to D) and two managed folders (F to G). The process of creating a managed file can start with a request. The request can identify the desired directory location where the managed file is to be created. The location can be identified in a variety of ways, for example, the location can be identified by the path, address, namespace of the file directory, or any other suitable data indicating the location within the directory structure. In an illustrative example, the location can include the OneDrive namespace. For the purpose of illustration, the location provided in the request is also referred to as the "requested location" in this article.

[0074] Reference Figure 2 , Figure 2Another example system 200 is shown, including a client device 226 and a file hosting platform 202 configured to maintain a copy of the file in the cloud database 204. The client device 226 can have a file I / O manager. For example, when an operation is performed on a moved file or folder 220 (M) of an individual file or folder 220 on a local drive 228 (e.g., a SATA-type solid-state hard drive and / or any other suitable drive type) of the client device 226, the system 200 can cause the file hosting platform 202 to locate the content data 222 of the file or folder 220 within the cloud database 204, depending on the location of the folder relative to the synchronization root. Therefore, as shown, an instance of the moved file or folder 220 (M) stored at the cloud database 204 can be synchronized with the content data 222. Example file hosting platforms 202 include, but are not limited to, DROPBOX, BOX, GOOGLE DRIVE, MEGA, PCLOUD, SUGARSYNC, AMAZON DRIVE, and / or MICROSOFTONE DRIVE.

[0075] In some embodiments, the file hosting platform 202 may include a directory structure 206 for storing data associated with one or more files or folders 220 within the cloud database 204. As used herein, the term "directory structure" may generally refer to any scheme by which a file system may display files to a user. Example directory structures include, but are not limited to, electronic folder structures. Figure 2 In a specific embodiment of the present invention, the directory structure 206 may include one or more folders 208 in which one or more files or folders 220 are stored. As used herein, the term "folder" may refer to a directory defined in a hierarchical file system catalog structure and may include references to one or more files 220 and / or individual files in other folders 220. The directory structure may also include a vault folder 209 containing files 222. As further described, the local counterparts of the files 220 and the vaulted files 222 may be synchronously dehydrated within the directory structure 206 at the local drive 228 and the file hosting platform 202.

[0076] As used herein, the term "synchronized" may be used as a descriptive term to indicate that an instance of a file or folder 220 at a particular storage location (e.g., cloud database 204, local drive 228, etc.) has its corresponding content data 222 also stored at the particular storage location. For example, in the illustrated example, an instance of a file or folder 220 stored in cloud database 204 may be described as a synchronized file or folder if its content data is also stored within cloud database 204.

[0077] In some embodiments, the client device 226 may include a user application 228 that provides access to one or more files 220 according to the directory structure 206. For example, the user application 228 may cause the client device 226 to display a file browser graphical user interface (GUI) that enables a user to navigate the directory structure 206. As a more specific but non-limiting example, the user application 228 may cause the client device to display graphical folder representations of individual folders in the folder 208, and may also display file icons within the graphical folder representations to enable the user to view the status of the files, and in some embodiments, open, move, delete, or copy files contained within the folder 208.

[0078] In some embodiments, the user application 228 can communicate with one or more components of the operating system (OS) 220 to display a file browser GUI and / or to facilitate the generation of selection data indicating the file or folder 220 and the destination path within the directory structure 206 to which the file or folder 220 is to be copied or moved. The OS 220 can be any suitable system software for managing computer hardware and / or software resources and for providing services to the user application 228 and / or other applications (not shown). Example OS 220 can include, but is not limited to, various versions of MICROSOFT WINDOWS (e.g., WINDOWS 8.2 or 20, WINDOWS EMBEDDED STANDARD 7, etc.) and / or various versions of macOS (e.g., macOS HIGH SIERRA, etc.).

[0079] In some examples, the user application 228 can communicate with the file manager 224 of the OS 220. Example file managers include, but are not limited to, the FILE EXPLORER component of MICROSOFT WINDOWS and / or the FINDER component of the MACINTOSH operating system family developed by Apple Inc. In some examples, the user application 228 can communicate with the file operation application programming interface (API) 222 of the OS 220. The file operation API 222 may include a data read function that enables the client device 226 to read data from a specified file or folder, and an abstraction of a data write function that enables the client device 226 to write data to a specified target path. Example user applications 228 include, but are not limited to, desktop client applications (e.g., DROPBOX APP desktop application developed by DROPBOX, BOX DRIVE desktop application developed by BOX, and / or ONEDRIVE desktop client) that are specifically configured to communicate with the file hosting platform 202. Therefore, it will be appreciated that in various embodiments, the user application 228 may be configured to maintain a local instance of the directory structure 206 and enable a user to browse the local instance of the directory structure 206 without constant communication with the file hosting platform 202 .

[0080] In some embodiments, the client device 226 may include a synchronization engine 226 for synchronizing a local instance of the directory structure 206 located at the client device 226 with a cloud instance of the directory structure 206 located at the cloud database 204. Example synchronization engines 226 include, but are not limited to, the SYNCHRONIZATION API developed by DROPBOX, the BACKUP AND SYNCHRONIZATION developed by GOOGLE, and the ONEDRIVE synchronization engine. Therefore, it is understood that the synchronization engine 226 may be a native component of the OS 220, or may be an additional component downloaded and installed on the client device 226 separate from the OS 220.

[0081] As further shown, the client device 226 includes a central processing unit ("CPU") 230, which is connected to various components such as local drives 228, memory 232, input / output (I / O) controllers 234, and / or network interfaces 236 via a bus (not shown). It is understood that the system components described herein (e.g., user applications 228, OS 220, and / or synchronization engine 226), when loaded into the CPU 230 and executed, can transform the CPU 230 and the entire client device 226 from a general-purpose computing system into a special-purpose computing system customized to facilitate the functions presented herein. The CPU 230 can be composed of any number of transistors or other discrete circuit elements, which can present any number of states individually or collectively. More specifically, in response to executable instructions contained in the software modules disclosed herein, the CPU 230 can act as a finite state machine. These computer executable instructions can transform the CPU 230 by specifying how the CPU 230 transitions between states, thereby transforming the transistors or other discrete hardware elements that constitute the CPU 230.

[0082] The local drive 228 and associated computer-readable media provide non-volatile storage for the client device 226. Although the description of computer-readable media contained herein refers to mass storage devices such as solid-state drives and / or hard disks, it should be understood by those skilled in the art that computer-readable media can be any available computer storage media or communication media that can be accessed by a computing architecture such as the system 200. Communication media include computer-readable instructions, data structures, program modules, and / or other data in a modulated data signal such as a carrier waveform or other transmission mechanism, and include any delivery media. The term "modulated data signal" means a signal that has one or more of its characteristics changed or set in a manner that encodes information in the signal. By way of example and not limitation, communication media include wired media such as a wired network or direct wire connection, and wireless media such as sound, RF, infrared, and other wireless media. Combinations of any of the above are also included within the scope of computer-readable media.

[0083] By way of example and not limitation, computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. For example, computer storage media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid-state memory technology, CD-ROM, digital versatile disk ("DVD"), HD-DVD, BLU-RAY or other optical storage, cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by the client device 226. For the purposes of the claims, the phrases "computer storage medium", "computer readable storage medium" and variations thereof do not by themselves include waves, signals and / or other transient and / or intangible communication media.

[0084] I / O controller 234 can receive and process input from a variety of other devices, including a keyboard, mouse, or electronic pen ( Figure 2 Similarly, I / O controller 234 may provide signals to a display screen (e.g., to display a file browser GUI as described herein), a printer, or other type of output device (also not shown). Figure 2 The network interface 236 may enable the client device 226 to connect to one or more networks 224, such as a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), or any other suitable network for communicating information between the client device 226 and the file hosting platform 202.

[0085] Reference Figure 3 , illustrates an example file browser GUI 300 that can be displayed at a client device 336 in association with a user application 338 to enable a user to enter commands for file or folder operations within a directory structure 306. In the illustrated example, the user is performing a drag-and-drop gesture to move a file 330 from a folder 308 to a vault 309. Based on the drag-and-drop gesture, the user application 338 generates selection data indicating the file 330 and a target path within the directory structure 306 to which the first file 330 is to be moved. As further illustrated, the client device 336 can generate a move instruction 206 based on the selection data, and ultimately can send at least some aspects of the move instruction 306 to the file hosting platform 302 according to the techniques described herein.

[0086] In some embodiments, the file browser GUI 300 can be configured to graphically indicate the status of the file 330. In the illustrated example, the file browser GUI 300 graphically represents the files within the folder 308. The file browser GUI 300 also graphically represents the vault 309, as indicated by the lock icon. Therefore, the user can know from the lock icon that the folder 309 is a vault. In various embodiments, the user can be able to specify which folders are converted to vaults.

[0087] Now turn to Figure 4 , aspects of a routine 400 for controlling access to data stored in a cloud-based storage service are shown and described below. It should be understood that the operations of the methods disclosed herein are not presented in any particular order, and that performing some or all of the operations in an alternative order is possible and contemplated. For ease of description and illustration, the operations have been presented in the order in which they are presented. The operations may be added, omitted, and / or performed simultaneously without departing from the scope of the appended claims.

[0088] It should also be understood that the method shown can be terminated at any time and does not need to be performed in its entirety. Some or all of the operations of the method and / or substantially equivalent operations can be performed by executing computer-readable instructions included on a computer storage medium, as defined below. The term "computer-readable instructions" and its variants used in the specification and claims are used broadly herein to include routines, applications, application modules, program modules, programs, components, data structures, algorithms, etc. Computer-readable instructions can be implemented on a variety of system configurations, including single-processor or multi-processor systems, minicomputers, mainframe computers, personal computers, handheld computing devices, microprocessor-based programmable consumer electronics, combinations thereof, and the like.

[0089] Therefore, it should be understood that the logical operations described herein are implemented as (1) a sequence of computer-implemented actions or program modules running on a computing system and / or (2) interconnected machine logic circuits or circuit modules within the computing system. The implementation is a matter of choice depending on the performance and other requirements of the computing system. Therefore, the logical operations described herein are variously referred to as states, operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules can be implemented in software, firmware, dedicated digital logic, and any combination thereof.

[0090] For example, the operation of routine 400 is described herein as being implemented at least in part by a module that runs the features disclosed herein, and may be a dynamic link library (DLL), a static link library, a function generated by an application programming interface (API), a compiler, an interpreter, a script, or any other executable instruction set. Data may be stored in a data structure in one or more memory components. Data may be retrieved from a data structure by addressing a link or reference to the data structure.

[0091] Although the following description relates to the components of the accompanying drawings, it is understood that the operation of routine 400 can also be implemented in many other ways. For example, routine 400 can be implemented at least in part by a processor of another remote computer or local circuit. In addition, one or more operations of routine 400 can be implemented at least in part by a chipset that works alone or in combination with other software modules, alternatively or additionally. In the examples described below, one or more modules of the computing system can receive and / or process the data disclosed herein. Any service, circuit or application suitable for providing the technology disclosed in this article can be used in the operation described in this article.

[0092] refer to Figure 4 , the routine 400 begins at operation 401, where a first request is received at a cloud-based storage service for accessing data stored at the cloud-based storage service. In one embodiment, the data is associated with a user account.

[0093] Next, at operation 403, the first request is authenticated based on the username and password associated with the user account.

[0094] Operation 405 illustrates receiving, at the cloud-based storage service, a second request for a file stored in a region associated with the enhanced authentication protocol.

[0095] Next, at operation 407, an enhanced authentication protocol is performed to authenticate the second request.

[0096] At operation 409, in response to authenticating the second request, a temporary strong authentication state is granted permission to access files stored in an area associated with the enhanced authentication protocol.

[0097] At operation 411 , in response to a failure to authenticate the second request, access to files stored in an area associated with the enhanced authentication protocol is denied while access to files stored in other areas associated with the user account is allowed.

[0098] Now turn to Figure 5 , aspects of a routine 500 for controlling access to data stored in a cloud-based storage service are shown and described below. Figure 5 , the routine 500 begins at operation 501 , which illustrates storing data associated with a user account at a cloud-based storage service.

[0099] Next, operation 503 illustrates receiving, at the cloud-based storage service, a first request to associate a portion of the data with an enhanced authentication protocol.

[0100] Operation 505 illustrates requiring an enhanced authentication protocol for access to a portion of the data in response to the first request.

[0101] Next, operation 507 illustrates receiving, at the cloud-based storage service, a second request for a file stored in a portion of the data associated with the enhanced authentication protocol.

[0102] Operation 509 illustrates authenticating the second request based on the enhanced authentication protocol.

[0103] Operation 511 illustrates granting permission to access a file stored in a portion of the data associated with the enhanced authentication protocol in response to authenticating the second request.

[0104] Operation 513 illustrates, in response to a failure to authenticate the second request, denying access to files stored in a portion of the data associated with the enhanced authentication protocol, while allowing access to files stored in other areas associated with the user account based on authentication according to a simple or basic authentication mechanism associated with the user account.

[0105] Now turn to Figure 6 , aspects of a routine 600 for controlling access to data stored in a cloud-based storage service are shown and described below. Figure 6 , the routine 600 begins at operation 601 , where data associated with a user account is stored at a cloud-based storage service.

[0106] Next, at operation 603, a portion of the data is associated with the enhanced authentication protocol.

[0107] Operation 605 illustrates receiving, at a cloud-based storage service, a request for an application to access data associated with an enhanced authentication protocol.

[0108] Next, at operation 607, the request is authenticated based on the enhanced authentication protocol.

[0109] At operation 609, in response to authenticating the request, permission is granted to the application to access data associated with the enhanced authentication protocol. In one embodiment, the permission is time-limited.

[0110] At operation 611, it is determined that a time limit has been reached.

[0111] Operation 613 illustrates determining that the application is editing data associated with the enhanced authentication protocol in response to determining that the time limit has been reached.

[0112] Operation 615 illustrates temporarily extending permission for an application to access data while the application is editing the data.

[0113] Now turn to Figure 7 , aspects of a routine 700 for controlling access to data stored in a cloud-based storage service are shown and described below. Figure 7 , the routine 700 begins at operation 701 , where data associated with a user account is stored at a cloud-based storage service.

[0114] Next, at operation 703, a portion of the data is associated with the enhanced authentication protocol.

[0115] Operation 705 shows receiving a request for an application to access data associated with an enhanced authentication protocol at a cloud-based storage service. In one embodiment, the request includes an indication that the application is designed to interact with the data using the enhanced authentication protocol.

[0116] Next, at operation 707, based on the indication, the request is authenticated based on the enhanced authentication protocol.

[0117] At operation 709, in response to authenticating the request, when the request includes an indication that the application is designed to interact with the data using the enhanced authentication protocol, visibility to the application is provided to the data associated with the enhanced authentication protocol.

[0118] Operation 711 illustrates hiding visibility of a portion of the data that utilizes the enhanced authentication protocol when the request does not include an indication that the application is designed to interact with the data utilizing the enhanced authentication protocol.

[0119] Now turn to Figure 8 , aspects of a routine 800 for facilitating access to data stored in a cloud-based storage service are shown and described below. Figure 8 , the routine 800 begins at operation 801 , where data associated with a user account is stored at a cloud-based storage service.

[0120] Next, at operation 803, a portion of the data is associated with the enhanced authentication protocol.

[0121] Operation 805 illustrates receiving, at a cloud-based storage service, a request for an application to receive data associated with an enhanced authentication protocol.

[0122] Next, at operation 807, in response to the request, the request is authenticated based on the enhanced authentication protocol.

[0123] At operation 809, in response to authenticating the request, permission is granted to the application to receive data associated with the enhanced authentication protocol.

[0124] Operation 811 illustrates sending an indication to an application that the data is unavailable in response to locking the data associated with the enhanced authentication protocol.

[0125] Fig. 9 A computer (eg, computing device 109 ( Figure 1 )) additional details of the example computer architecture 900. Thus, Fig. 9 The computer architecture 900 shown illustrates an architecture for a server computer, a mobile phone, a PDA, a smart phone, a desktop computer, a netbook computer, a tablet computer, and / or a laptop computer. The computer architecture 900 can be used to perform any aspect of the software components presented herein.

[0126] Fig. 9 The illustrated computer architecture 900 includes a central processing unit 902 ("CPU"), a system memory 904 including random access memory 909 ("RAM") and read only memory ("ROM") 908, and a system bus 910 that couples the memory 904 to the CPU 902. A basic input / output system, containing basic routines that help transfer information between elements within the computer architecture 900 (such as during startup), is stored in the ROM 908. The computer architecture 900 also includes a mass storage device 912 for storing an operating system 907, other data, and one or more application programs such as the productivity application 141 and the synchronization application 142.

[0127] The mass storage device 912 is connected to the CPU 902 through a mass storage controller (not shown) connected to the bus 910. The mass storage device 912 and its associated computer readable media provide non-volatile storage for the computer architecture 900. Although the description of computer readable media contained herein refers to mass storage devices such as solid state drives, hard disks, or CD-ROM drives, it should be understood by those skilled in the art that computer readable media can be any available computer storage media or communication media that can be accessed by the computer architecture 900.

[0128] Communication media includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier waveform or other transmission mechanism, and includes any delivery medium. The term "modulated data signal" means a signal that has one or more of its characteristics changed or set in a manner that encodes information in the signal. By way of example and not limitation, communication media include wired media such as a wired network or a direct wire connection, and wireless media such as sound, RF, infrared and other wireless media. Any combination of the above items should also be included within the scope of computer readable media.

[0129] By way of example and not limitation, computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. For example, computer media include, but are not limited to: RAM, ROM, EPROM, EEPROM, flash memory or other solid-state-memory technology, CD-ROM, digital versatile disk ("DVD"), HD-DVD, BLU-RAY or other optical storage, cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by the computer architecture 900. For the purposes of the claims, the phrases "computer storage medium", "computer readable storage medium" and variations thereof do not by themselves include waves, signals and / or other transient and / or intangible communication media.

[0130] According to various configurations, the computer architecture 900 can operate in a networked environment using logical connections to remote computers through the network 959 and / or another network (not shown). The computer architecture 900 can be connected to the network 959 via a network interface unit 914 connected to the bus 910. It should be understood that the network interface unit 914 can also be used to connect to other types of networks and remote computer systems. The computer architecture 900 can also include a computer for receiving and processing commands from a keyboard, a mouse, or an electronic pen ( Fig. 9 The input / output controller 919 can also be used to control the input of multiple other devices (not shown). Similarly, the input / output controller 919 can provide input to a display screen, a printer, or other types of output devices ( Fig. 9 (not shown) provides an output.

[0131] It should be understood that the software components described herein, when loaded into the CPU 902 and executed, transform the CPU 902 and the entire computer architecture 900 from a general-purpose computing system into a special-purpose computing system customized to facilitate the functions presented herein. The CPU 902 can be composed of any number of transistors or other discrete circuit elements, which can present any number of states individually or collectively. More specifically, in response to the executable instructions contained in the software modules disclosed herein, the CPU 902 can act as a finite state machine. These computer executable instructions can transform the CPU 902 by specifying how the CPU 902 switches between states, thereby transforming the transistors or other discrete hardware elements that constitute the CPU 902.

[0132] Encoding the software modules presented herein may also transform the physical structure of the computer-readable medium presented herein. The specific information of the physical structure may depend on various factors in different embodiments of this specification. Examples of these factors may include, but are not limited to: the technology used to implement the computer-readable medium, whether the computer-readable medium is characterized as primary storage or auxiliary storage, etc. For example, if the computer-readable medium is implemented as a semiconductor-based memory, the software disclosed herein may be encoded on the computer-readable medium by transforming the physical state of the semiconductor memory. For example, the software may transform the state of transistors, capacitors, or other discrete circuit elements that constitute the semiconductor memory. The software may also transform the physical state of these components in order to store data thereon.

[0133] As another example, the computer readable medium disclosed herein can be implemented using magnetic or optical technology. In such an embodiment, when the software is encoded therein, the software presented herein can convert the physical state of the magnetic or optical medium. These conversions can include changing the magnetic properties of a specific location in a given magnetic medium. These conversions can also include changing the physical characteristics or properties of a specific location in a given optical medium to change the optical properties of those locations. Other conversions of physical media are possible without departing from the scope and spirit of this specification, and the aforementioned examples are provided only to facilitate this discussion.

[0134] In view of the above description, it should be understood that many types of physical transformations occur in the computer architecture 900 in order to store and execute the software components presented herein. It should also be understood that the computer architecture 900 may include other types of computing devices, including handheld computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those skilled in the art. It is also contemplated that the computer architecture 900 may not include Fig. 9 All components shown may include Fig. 9 Other components not explicitly shown in the figure or the like may be used Fig. 9 The architecture shown is a completely different architecture.

[0135] Fig.10 An illustrative distributed computing environment 1000 capable of executing the software components described herein is depicted. Fig.10 The distributed computing environment 1000 shown in FIG. 1 can be used to perform any aspects of the software components presented herein. For example, the distributed computing environment 1000 can be used to perform aspects of the software components described herein.

[0136] According to various implementations, the distributed computing environment 1000 includes a computing environment 1002 that operates on, communicates with, or is part of a network 1004. The network 1004 may be or may include the computing environment 1002 described above with reference to Fig. 9 The network 1004 may also include various access networks. One or more client devices 1006A-1006N (hereinafter collectively and / or generally referred to as "client 1006", also referred to as computing device 106 in this article) may be connected to the network 1004 and / or other connections ( Fig.10 1002). In one illustrated configuration, the clients 1006 include computing devices 1006A, such as laptop computers, desktop computers, or other computing devices; tablet or tablet computing devices ("tablet computing devices") 1006B; mobile computing devices 1006C, such as mobile phones, smart phones, or other mobile computing devices; server computers 1006D; and / or other devices 1006N. It should be understood that any number of clients 1006 can communicate with the computing environment 1002. Reference herein to Fig. 9 and 10 Two example computing architectures are shown and described for the client 1006. It should be understood that the illustrated client 1006 and the computing architectures shown and described herein are illustrative and should not be construed as being limiting in any way.

[0137] In the illustrated configuration, the computing environment 1002 includes an application server 1008, a data store 1010, and one or more network interfaces 1012. According to various embodiments, the functionality of the application server 1008 may be provided by one or more server computers that are part of the network 1004 or in communication with the network 503. The application server 1008 may host various services, virtual machines, portals, and / or other resources. In the illustrated configuration, the application server 1008 hosts one or more virtual machines 1014 for hosting applications or other functions. According to various embodiments, the virtual machine 1014 hosts one or more applications and / or software modules for implementing in-application support for file topology changes during remote synchronization. It should be understood that this configuration is illustrative and should not be interpreted as limiting in any way. The application server 1008 also hosts or provides access to one or more portals, link pages, websites, and / or other information ("portal websites") 1016.

[0138] According to various embodiments, the application server 1008 also includes one or more mailbox services 1018 and one or more messaging services 1020. The mailbox service 1018 may include an electronic mail ("email") service. The mailbox service 1018 may also include various personal information management ("PIM") and presence services, including but not limited to calendar services, contact management services, collaboration services, and / or other services. The messaging service 1020 may include but is not limited to instant messaging services, chat services, forum services, and / or other communication services.

[0139] The application server 1008 may also include one or more social networking services 1022. The social networking service 1022 may include various social networking services, including but not limited to: services for sharing or posting status updates, instant messages, links, photos, videos, and / or other information; services for commenting on or showing interest in articles, products, blogs, or other resources; and / or other services. In some configurations, the social networking service 1022 is provided by FACEBOOK social networking service, LINKEDIN professional network service, MYSPACE social networking service, FOURSQUARE geographic network service, YAMMER office colleague network service, etc., or includes ACEBOOK social networking service, LINKEDIN professional network service, MYSPACE social networking service, FOURSQUARE geographic network service, YAMMER office colleague network service. In other configurations, the social networking service 1022 is provided by other services, sites, and / or providers, which may or may not be explicitly referred to as social networking providers. For example, some websites allow users to interact with each other via email, chat services, and / or other means during various activities and / or contexts (e.g., reading published articles, commenting on goods or services, publishing, collaborating, playing games, etc.). Examples of such services include, but are not limited to, the WINDOWSLIVE service and the XBOX LIVE service from MICROSOFT CORPORATION of Redmond, Wash. Other services are possible and contemplated.

[0140] The social networking service 1022 may also include comment, blog and / or microblogging services. Examples of such services include, but are not limited to, the YELP comment service, the KUDZU comment service, the OFFICETALK enterprise microblogging service, the TWITTER messaging service, the GOOGLE BUZZ service, and / or other services. It should be understood that the above list of services is not exhaustive, and for the sake of brevity, many additional and / or alternative social networking services 1022 are not mentioned herein. Therefore, the above configuration is illustrative and should not be interpreted as being limited in any way. According to various embodiments, the social networking service 1022 may host one or more applications and / or software modules to provide the functionality described herein, such as enabling in-application support for file topology changes during remote synchronization. For example, any one of the application servers 1008 may transmit or facilitate the functionality and features described herein. For example, a social networking application, mail client, messaging client, or browser running on a phone or any other client 1006 may communicate with the network service 1022 and facilitate the above description of the social networking service 1022. Fig.10 The functionality described, even if partial. Any device or service described in this article may be used as a resource for supplemental data, including email servers, storage servers, etc.

[0141] like Fig.10 As shown, the application server 1008 may also host other services, applications, portals, and / or other resources ("other resources") 1024. Other resources 1024 may include, but are not limited to, document sharing, rendering, or any other functionality. It is therefore understood that the computing environment 1002 may provide integration of the concepts and technologies disclosed herein with various mailboxes, messaging, social networks, and / or other services or resources.

[0142] As described above, computing environment 1002 may include data store 1010. According to various embodiments, the functionality of data store 1010 is provided by one or more databases operating on network 1004 or in communication with network 503. The functionality of data store 1010 may also be provided by one or more server computers configured to host data for computing environment 1002. Data store 1010 may include, host, or provide one or more real or virtual data repositories 1026A-1026N (hereinafter collectively and / or generally referred to as "data repositories 1026"). Data repositories 1026 are configured to host data used or created by application servers 105 and / or other data. Although not described herein, data repositories 1026 may be used to store data used or created by application servers 105 and / or other data. Fig.10 , but data repository 1026 may also host or store web documents, word documents, presentation documents, data structures, algorithms executed by the recommendation engine, and / or other data used by any application or another module. Aspects of data repository 1026 may be associated with a service for storing files.

[0143] The computing environment 1002 can communicate with or be accessed by a network interface 1012. The network interface 1012 may include various types of network hardware and software for supporting communications between two or more computing devices (including, but not limited to, computing devices and servers). It should be understood that the network interface 1012 may also be used to connect to other types of networks and / or computer systems.

[0144] It should be understood that the distributed computing environment 1000 described herein can utilize any number of virtual computing resources and / or other distributed computing functions that can be configured to perform any aspects of the software components disclosed herein to provide any aspects of the software units described herein. According to various embodiments of the concepts and technologies disclosed herein, the distributed computing environment 1000 provides the software functions described herein as a service to a computing device. It should be understood that a computing device may include a real machine or a virtual machine, including but not limited to a server computer, a network server, a personal computer, a mobile computing device, a smart phone, and / or other devices. Therefore, various configurations of the concepts and technologies disclosed herein enable any device configured to access the distributed computing environment 1000 to utilize the functions described herein to provide the technology disclosed herein, etc. In one specific example, as summarized above, the technology described herein may be at least partially implemented by a computer system that is related to Fig.10 The application server 1008 is implemented in conjunction with a working web browser application.

[0145] Now turn to Fig.11 , an illustrative computing device architecture 1100 for a computing device capable of executing the various software components described herein for supporting within an application for implementing topological changes to files during remote synchronization. The computing device architecture 1100 is applicable to computing devices that facilitate mobile computing due in part to form factor, wireless connectivity, and / or battery-powered operation. In some configurations, the computing devices include, but are not limited to, mobile phones, tablet devices, slate devices, portable video game devices, and the like. The computing device architecture 1100 is applicable to Figure 1 , Figure 2 , Fig. 9 , Fig.10 100. In addition, aspects of computing device architecture 1100 can be applicable to conventional desktop computers, portable computers (e.g., phones, laptops, notebooks, ultraportable computers, and netbooks), server computers, and other computer systems, as described herein. For example, the single-touch and multi-touch aspects disclosed below can be applied to a desktop computer that utilizes a touch screen or some other touch-enabled device (e.g., a touch-enabled track pad or a touch-enabled mouse).

[0146] Fig.11 The computing device architecture 1100 shown in FIG. 1 includes a processor 1102, a memory component 1104, a network connection component 1106, a sensor component 11011, an input / output component 1110, and a power component 1112. In the configuration shown, the processor 1102 communicates with the memory component 1104, the network connection component 1106, the sensor component 11011, the input / output ("I / O") component 1110, and the power component 1112. Although in FIG. Fig.11No connections are shown between the individual components illustrated in the diagram, but the components may interact to perform device functions. In some configurations, the components are arranged to communicate via one or more buses (not shown).

[0147] The processor 1102 includes a central processing unit ("CPU") configured to process data, execute computer-executable instructions of one or more applications, and communicate with other components of the computing device architecture 1100 in order to perform the various functions described herein. The processor 1102 can be used to execute various aspects of the software components presented herein, and in particular, at least in part, to utilize aspects of touch-enabled input.

[0148] In some configurations, the processor 1102 includes a graphics processing unit (“GPU”) configured to accelerate operations performed by the CPU, including, but not limited to, operations performed by executing general scientific and / or engineering computing applications, as well as graphics-intensive computing applications such as high-resolution video (e.g., 720P, 10110P, and higher resolutions), video games, three-dimensional (“3D”) modeling applications, and the like. In some configurations, the processor 1102 is configured to communicate with a discrete GPU (not shown). In any case, the CPU and GPU can be configured according to a co-processing CPU / GPU computing model, in which sequential portions of an application are executed on the CPU and computationally intensive portions are accelerated by the GPU.

[0149] In some configurations, the processor 1102 is or is included in a system on a chip ("SoC") and one or more other components described below. For example, the SoC may include the processor 1102, a GPU, one or more network connection components in the network connection component 1106, and one or more sensor components in the sensor component 11011. In some configurations, the processor 1102 is manufactured in part using a package-on-package ("PoP") integrated circuit packaging technology. The processor 1102 may be a single-core or multi-core processor.

[0150] The processor 1102 may be created in accordance with the ARM architecture, which is licensed from ARM HOLDINGS of Cambridge, England. Alternatively, the processor 1102 may be created in accordance with the x116 architecture, such as is available from Intel Corporation of Mountain View, California and other companies. In some configurations, the processor 1102 is a SNAPDRAGON SoC available from QUALCOMM of San Diego, California, a TEGRA SoC available from NVIDIA of Santa Clara, California, a HUMMINGBIRD SoC available from SAMSUNG of Seoul, South Korea, an Open Multimedia Application Platform ("OMAP") SoC available from TEXASINSTRUMENTS of Dallas, Texas, a customized version of any of the above SoCs, or a proprietary SoC.

[0151] The memory component 1104 includes random access memory (“RAM”) 1114, read-only memory (“ROM”) 1116, integrated storage memory (“integrated storage”) 11111, and removable storage memory (“removable storage”) 1120. In some configurations, RAM 1114 or a portion thereof, ROM 1116 or a portion thereof, and / or some combination of RAM 1114 and ROM 1116 are integrated into the processor 1102. In some configurations, ROM 1116 is configured to store firmware, an operating system or a portion thereof (e.g., an operating system kernel), and / or a boot loader to load the operating system kernel from the integrated storage 11111 and / or the removable storage 1120.

[0152] The integrated storage 11111 may include a solid-state memory, a hard disk, or a combination of a solid-state memory and a hard disk. The integrated storage 11111 may be soldered or otherwise connected to a logic board, to which the processor 1102 and other components described herein may also be connected. In this way, the integrated storage 11111 is integrated into the computing device. The integrated storage 11111 is configured to store an operating system or part thereof, applications, data, and other software components described herein.

[0153] Removable storage 1120 may include solid-state memory, a hard disk, or a combination of solid-state memory and a hard disk. In some configurations, removable storage 1120 is provided in place of integrated storage 11111. In other configurations, removable storage 1120 is provided as additional optional storage. In some configurations, removable storage 1120 is logically combined with integrated storage 11111 so that the total available storage is available as the total combined storage capacity. In some configurations, the total combined capacity of integrated storage 11111 and removable storage 1120 is displayed to the user, rather than the individual storage capacities of integrated storage 11111 and removable storage 1120.

[0154] The removable storage 1120 is configured to be inserted into a removable storage memory slot (not shown) or other mechanism through which the removable storage 1120 is inserted and secured to facilitate a connection through which the removable storage 1120 can communicate with other components of the computing device, such as the processor 1102. The removable storage 1120 can be embodied in various memory card formats, including but not limited to PC card, compact flash card, memory stick, secure digital ("SD"), miniSD, microSD, universal integrated circuit card ("UICC") (e.g., user identity module ("SIM") or universal SIM ("USFM")), proprietary formats, etc.

[0155] It is understood that one or more of the memory components 1104 can store an operating system. According to various configurations, operating systems include, but are not limited to, WINDOWS MOBILEOS from Microsoft Corporation of Redmond, Washington, WINDOWS PHONE OS from Microsoft Corporation, WINDOWS from Microsoft Corporation, PALM WEBOS from Hewlett-Packard Company of Palo Alto, California, BlackBerry operating system from Research In Motion Limited of Waterloo, Ontario, Canada, IOS operating system from Apple Inc. of Cupertino, California, and Android operating system from Google Inc. of Mountain View, California. Other operating systems are contemplated.

[0156] The network connection component 1106 includes a wireless wide area network component ("WWAN component") 1122, a wireless local area network component ("WLAN component") 1124, and a wireless personal area network component ("WPAN component") 1126. The network connection component 1106 facilitates communication to and from a network 1156 or another network (which may be a WWAN, WLAN, or WPAN). Although only network 1156 is shown, the network connection component 1106 can facilitate communication with multiple networks (including Figure 6 For example, the network connectivity component 1106 can facilitate simultaneous communication with multiple networks via one or more of a WWAN, a WLAN, or a WPAN.

[0157] The network 1156 may be or may include a WWAN, such as a mobile telecommunication network utilizing one or more mobile telecommunication technologies to provide voice and / or data services to computing devices utilizing the computing device architecture 1100 via the WWAN component 1122. The mobile telecommunication technologies may include, but are not limited to, Global System for Mobile Communications (“GSM”), Code Division Multiple Access (“CDMA”) ONE, CDMA7000, Universal Mobile Telecommunications System (“UMTS”), Long Term Evolution (“LTE”), and Worldwide Interoperability for Microwave Access (“WiMAX”). In addition, the network 1156 may utilize various channel access methods (which may or may not be used by the above standards), including, but not limited to, Time Division Multiple Access (“TDMA”), Frequency Division Multiple Access (“FDMA”), CDMA, Wideband CDMA (“W-CDMA”), Orthogonal Frequency Division Multiplexing (“OFDM”), Space Division Multiple Access (“SDMA”), and the like. Data communications may be provided using General Packet Radio Service ("GPRS"), Enhanced Data Rates for Global Evolution ("EDGE"), High Speed ​​Packet Access ("HSDPA") protocol family including High Speed ​​Downlink Packet Access ("HSPA"), Enhanced Uplink ("EUL") or otherwise known as High Speed ​​Uplink Packet Access ("HSUPA"), Evolved HSPA ("HSPA+"), LTE, and various other current and future wireless data access standards. Network 1156 may be configured to provide voice and / or data communications using any combination of the above technologies. Network 1156 may be configured or adapted to provide voice and / or data communications in accordance with next generation technologies.

[0158] In some configurations, the WWAN component 1122 is configured to provide dual-mode multi-mode connectivity to the network 1156. For example, the WWAN component 1122 may be configured to provide connectivity to a network 1156 that provides services via GSM and UMTS technologies or via some other combination of technologies. Alternatively, multiple WWAN components 1122 may be utilized to perform such functions, and / or to provide additional functionality to support other incompatible technologies (i.e., that cannot be supported by a single WWAN component). The WWAN component 1122 may facilitate similar connectivity to multiple networks (e.g., a UMTS network and an LTE network).

[0159] The network 1156 may be a WLAN operating in accordance with one or more Institute of Electrical and Electronics Engineers ("IEEE") 1102.11 standards, such as IEEE 1102.11a, 1102.11b, 1102.11g, 1102.11n, and / or future 1102.11 standards (collectively referred to herein as WI-FI). Draft 1102.11 standards are also considered. In some configurations, the WLAN is implemented using one or more wireless WI-FI access points. In some configurations, one or more of the wireless WI-FI access points is another computing device having a connection to a WWAN that acts as a WI-FI hotspot. The WLAN component 1124 is configured to connect to the network 1156 via a WI-FI access point. Such a connection may be protected via various encryption technologies, including but not limited to WI-FI Protected Access ("WPA"), WPA2, Wired Equivalent Privacy ("WEP"), and the like.

[0160] The network 1156 may be a WPAN operating in accordance with the Infrared Data Association ("IrDA"), Bluetooth, wireless Universal Serial Bus ("USB"), Z-Wave, ZIGBEE, or some other short-range wireless technology. In some configurations, the WPAN component 1126 is configured to facilitate communication with other devices such as peripherals, computers, or other computing devices via the WPAN.

[0161] The sensor assembly 11011 includes a magnetometer 11211, an ambient light sensor 1130, a proximity sensor 1132, an accelerometer 1134, a gyroscope 1136, and a global positioning system sensor (“GPS sensor”) 11311. It is contemplated that other sensors, such as but not limited to temperature sensors or shock detection sensors, may also be incorporated into the computing device architecture 1100.

[0162] The magnetometer 11211 is configured to measure the strength and direction of a magnetic field. In some configurations, the magnetometer 11211 provides measurements to a compass application stored in a memory component in the memory component 1104 to provide the user with accurate directions in a reference system including the cardinal directions north, south, east, and west. Similar measurements may be provided to a navigation application that includes a compass component. Other uses of the measurements obtained by the magnetometer 11211 are contemplated.

[0163] The ambient light sensor 1130 is configured to measure ambient light. In some configurations, the ambient light sensor 1130 provides the measurements to an application stored in one of the memory components 1104 to automatically adjust the brightness of the display (described below) to compensate for low light and high light environments. Other uses of the measurements obtained by the ambient light sensor 1130 are contemplated.

[0164] The proximity sensor 1132 is configured to detect the presence of an object or body near the computing device without direct contact. In some configurations, the proximity sensor 1132 detects the presence of a user's body (e.g., the user's face) and provides the information to an application stored in one of the memory components 1104, which uses the proximity information to enable or disable a feature of the computing device. For example, a phone application can automatically disable a touch screen (described below) in response to receiving proximity information so that the user's face during a call does not inadvertently end the call or enable / disable other features within the phone application. Other uses of the proximity detected by the proximity sensor 1132 are contemplated.

[0165] The accelerometer 1134 is configured to measure the correct acceleration. In some configurations, the output from the accelerometer 1134 is used by the application as an input mechanism to control some functions of the application. For example, the application can be a video game in which a character, a portion thereof, or an object is moved or otherwise manipulated in response to input received via the accelerometer 1134. In some configurations, the output from the accelerometer 1134 is provided to the application for switching between landscape and portrait modes, calculating coordinate acceleration, or detecting falls. Other uses of the accelerometer 1134 are contemplated.

[0166] The gyroscope 1136 is configured to measure and maintain orientation. In some configurations, the output from the gyroscope 1136 is used by an application as an input mechanism to control some function of the application. For example, the gyroscope 1136 can be used to accurately identify movement within a 3D environment of a video game application or some other application. In some configurations, an application utilizes the output from the gyroscope 1136 and the accelerometer 1134 to enhance control of a function of the application. Other uses of the gyroscope 1136 are contemplated.

[0167] The GPS sensor 11311 is configured to receive signals from GPS satellites for calculating a location. The location calculated by the GPS sensor 11311 can be used by any application that needs or benefits from location information. For example, the location calculated by the GPS sensor 11311 can be used with a navigation application to provide directions from the location to the destination or from the destination to the location. In addition, the GPS sensor 11311 can be used to provide location information to external location-based services such as E911. The GPS sensor 11311 can utilize one or more of the network connection components 1106 to obtain location information generated via WI-FI, WIMAX and / or cellular triangulation technology to help the GPS sensor 11311 obtain positioning. The GPS sensor 11311 can also be used in an assisted GPS ("A-GPS") system. The GPS sensor 11311 can also operate with other components such as the processor 1102 to generate positioning data for the computing device 1100.

[0168] The I / O component 1110 includes a display 1140, a touch screen 1142, a data I / O interface component ("data I / O") 1144, an audio I / O interface component ("audio I / O") 1146, a video I / O interface component ("video I / O") 11411, and a camera 1150. In some configurations, the display 1140 and the touch screen 1142 are combined. In some configurations, two or more of the data I / O component 1144, the audio I / O component 1146, and the video I / O component 11411 are combined. The I / O component 1110 may include a discrete processor configured to support the various interfaces described below, or may include processing functionality built into the processor 1102.

[0169] Display 1140 is an output device configured to present information in a visual form. Specifically, display 1140 can present graphical user interface ("GUI") elements, text, images, video, notifications, virtual buttons, virtual keyboards, messaging data, Internet content, device status, time, date, calendar data, preferences, map information, location information, and any other information that can be presented in a visual form. In some configurations, display 1140 is a liquid crystal display ("LCD") utilizing any active or passive matrix technology and any backlight technology (if used). In some configurations, display 1140 is an organic light emitting diode ("OLED") display. Other display types are contemplated.

[0170] The touch screen 1142, which is also referred to herein as a "touch-enabled screen," is an input device configured to detect the presence and location of a touch. The touch screen 1142 may be a resistive touch screen, a capacitive touch screen, a surface acoustic wave touch screen, an infrared touch screen, an optical imaging touch screen, a dispersive signal touch screen, an acoustic pulse recognition touch screen, or may utilize any other touch screen technology. In some configurations, the touch screen 1142 is incorporated on top of the display 1140 as a transparent layer to enable a user to interact with objects or other information presented on the display 1140 using one or more touches. In other configurations, the touch screen 1142 is a touch pad incorporated on a surface of a computing device that does not include the display 1140. For example, a computing device may have a touch screen incorporated on top of the display 1140 and a touch pad on a surface opposite the display 1140.

[0171] In some configurations, the touch screen 1142 is a single-touch touch screen. In other configurations, the touch screen 1142 is a multi-touch touch screen. In some configurations, the touch screen 1142 is configured to detect discrete touches, single-touch gestures, and / or multi-touch gestures. For convenience, these are collectively referred to as gestures herein. Several gestures will now be described. It should be understood that these gestures are illustrative and are not intended to limit the scope of the appended claims. In addition, the described gestures, additional gestures, and / or alternative gestures can be implemented in software for use with the touch screen 1142. Therefore, developers can create gestures specific to specific applications.

[0172] In some configurations, the touch screen 1142 supports a tap gesture, in which a user taps the touch screen 1142 once on an item presented on the display 1140. The tap gesture can be used for various reasons, including but not limited to opening or launching whatever the user tapped. In some configurations, the touch screen 1142 supports a double-tap gesture, in which a user taps the touch screen 1142 twice on an item presented on the display 1140. The double-tap gesture can be used for various reasons, including but not limited to zooming in or out in stages. In some configurations, the touch screen 1142 supports a tap and hold gesture, in which a user taps the touch screen 1142 and maintains contact for at least a predefined time. The tap and hold gesture can be used for various reasons, including but not limited to opening a context-specific menu.

[0173] In some configurations, the touch screen 1142 supports a pan gesture, in which a user places a finger on the touch screen 1142 and maintains contact with the touch screen 1142 while moving the finger on the touch screen 1142. The pan gesture can be used for various reasons, including but not limited to moving a screen, image, or menu at a controlled rate. Multiple finger pan gestures are also contemplated. In some configurations, the touch screen 1142 supports a flick gesture, in which a user slides a finger in the direction in which the user wants the screen to move. The flick gesture can be used for various reasons, including but not limited to scrolling horizontally or vertically through a menu or page. In some configurations, the touch screen 1142 supports a pinch and stretch gesture, in which a user uses two fingers (e.g., a thumb and an index finger) to perform a pinching motion on the touch screen 1142 or move the two fingers apart. The pinch and stretch gesture can be used for various reasons, including but not limited to gradually zooming in or out of a website, map, or picture.

[0174] Although the above gestures have been described with reference to being performed using one or more fingers, other appendages such as toes or objects such as a stylus may be used to interact with the touch screen 1142. Therefore, the above gestures should be understood to be illustrative and should not be construed as limiting in any way.

[0175] The data I / O interface component 1144 is configured to facilitate input of data to and output of data from the computing device. In some configurations, the data I / O interface component 1144 includes a connector configured to provide a wired connection between the computing device and the computer system, for example, for the purpose of synchronization operations. The connector can be a proprietary connector or a standardized connector, such as USB, micro USB, mini USB, etc. In some configurations, the connector is a docking connector for docking the computing device with another device, such as a docking station, an audio device (e.g., a digital music player), or a video device.

[0176] The audio I / O interface component 1146 is configured to provide audio input and / or output functionality to the computing device. In some configurations, the audio I / O interface component 1146 includes a microphone configured to collect audio signals. In some configurations, the audio I / O interface component 1146 includes a headphone jack that is configured to provide a connection for headphones or other external speakers. In some configurations, the audio I / O interface component 1146 includes a speaker for outputting audio signals. In some configurations, the audio I / O interface component 1146 includes an optical audio cable output.

[0177] The video I / O interface component 11411 is configured to provide video input and / or output functionality to the computing device. In some configurations, the video I / O interface component 11411 includes a video connector that is configured to receive video as input from another device (e.g., a video media player such as a DVD or BLURAY player) or send video as output to another device (e.g., a monitor, a television, or some other external display). In some configurations, the video I / O interface component 11411 includes a High-Definition Multimedia Interface (“HDMI”), mini HDMI, micro HDMI, display port, or proprietary connector for input / output of video content. In some configurations, the video I / O interface component 11411 or a portion thereof is combined with the audio I / O interface component 1146 or a portion thereof.

[0178] The camera 1150 can be configured to capture still images and / or video. The camera 1150 can capture images using a charge coupled device ("CCD") or a complementary metal oxide semiconductor ("CMOS") image sensor. In some configurations, the camera 1150 includes a flash to help take pictures in low light environments. The settings of the camera 1150 can be implemented as hardware or software buttons.

[0179] Although not shown, one or more hardware buttons may also be included in the computing device architecture 1100. The hardware buttons may be used to control some operational aspects of the computing device. The hardware buttons may be dedicated buttons or multi-purpose buttons. The hardware buttons may be mechanical or sensor-based.

[0180] The illustrated power assembly 1112 includes one or more batteries 1152, which can be connected to a battery gauge 1154. The batteries 1152 can be rechargeable or disposable. Rechargeable battery types include, but are not limited to, lithium polymer, lithium ion, nickel cadmium, and nickel metal hydride. Each battery in the battery 1152 can be made of one or more cells.

[0181] The battery gauge 1154 can be configured to measure battery parameters such as current, voltage, and temperature. In some configurations, the battery gauge 1154 is configured to measure the effects of the battery's discharge rate, temperature, age, and other factors to predict the remaining life within a certain percentage error. In some configurations, the battery gauge 1154 provides the measurements to an application that is configured to use the measurements to present useful power management data to the user. The power management data can include one or more of the following: percentage of battery used, percentage of battery remaining, battery condition, time remaining, remaining capacity (e.g., in watt-hours), current consumption, and voltage.

[0182] The power assembly 1112 may also include a power connector, which may be combined with one or more of the aforementioned I / O assemblies 1110. The power assembly 1112 may interface with an external power system or charging device via the I / O assembly.

[0183] Finally, although various configurations have been described in language specific to structural features and / or methodological acts, it should be understood that the inventive subject matter defined in the accompanying representations is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts are disclosed as example forms of implementing the claimed inventive subject matter.

[0184] Sample Clauses

[0185] The disclosure presented herein may be considered in light of the following terms.

[0186] Example clause A, a method for controlling access to data stored in a cloud-based storage service, the method comprising:

[0187] receiving, at the cloud-based storage service, a request to access data stored at the cloud-based storage service, the data being associated with a user account;

[0188] authenticating the first request based on a username and password associated with the user account;

[0189] receiving, at the cloud-based storage service, a second request for a file stored in a region associated with an enhanced authentication protocol;

[0190] executing the enhanced authentication protocol to authenticate the second request;

[0191] In response to authenticating the second request, granting a temporary strong authentication state permission to access the file stored in the area associated with the enhanced authentication protocol; and

[0192] In response to a failure to authenticate the second request, access to the file stored in the zone associated with the enhanced authentication protocol is denied while allowing access to files stored in other zones associated with the user account.

[0193] Example clause B, a method according to example clause A, wherein the permission is based on using an access control list (ACL) to grant access to the authentication state.

[0194] Example clause C, a method according to example clause B, wherein the ACL automatically expires after a predetermined time.

[0195] Example clause D, a method as described in any of example clauses A to C, wherein the permission is not granted to a security principal.

[0196] Example clause E. The method of any one of example clauses A to D further includes: hiding visibility of the area associated with the enhanced authentication protocol when the enhanced authentication protocol has not been executed.

[0197] Example clause F, a method according to any one of example clauses A to D, wherein the temporary strong authentication state is associated with an expiration time.

[0198] Example clause G, a method as described in any of example clauses A to F, wherein the file is accessed via a file system.

[0199] Although example clauses A through G are described above with respect to a method, it should be understood in the context of the present disclosure that the subject matter of example clauses A through G may additionally or alternatively be implemented as a system, a computing device, or via a computer-readable storage medium.

[0200] Example clause H, a system for controlling operations performed in a cloud-based storage service, the system comprising:

[0201] one or more data processing units;

[0202] A computer-readable medium having encoded thereon computer-executable instructions for causing the one or more data processing units to perform operations including:

[0203] receiving a first request to perform an operation on data associated with a user account;

[0204] authenticating the first request based on a username and password associated with the user account;

[0205] receiving a second request for an operation associated with the enhanced authentication protocol;

[0206] executing the enhanced authentication protocol to authenticate the second request;

[0207] In response to authenticating the second request, granting a temporary strong authentication state permission to perform the operation associated with the enhanced authentication protocol on the data associated with the user account; and

[0208] In response to a failure to authenticate the second request, the request to perform the operation associated with the enhanced authentication protocol is denied while allowing operations not associated with the enhanced authentication protocol to be performed.

[0209] Example clause I, a system according to example clause H, wherein the permission is based on using an access control list (ACL) to grant access to the authentication state.

[0210] Example clause J, a system according to example clause H or example clause I, wherein the ACL automatically expires after a predetermined time.

[0211] Example clause K, a system according to example clauses H to example clauses J, wherein the permission is not granted to the security principal.

[0212] Example Clause L, a system according to Example Clauses H to Example Clauses K, further comprising: hiding visibility of the data associated with the user account when the enhanced authentication protocol has not been executed.

[0213] Example clause M, a system according to example clauses H to example clauses L, wherein the temporary strong authentication state is associated with an expiration time.

[0214] Example clause N, a computing device as described in example clauses H to example clauses M, wherein the data is accessed via a file system.

[0215] Although example clauses H through N are described above with respect to a system, it should be understood in the context of the present disclosure that the subject matter of example clauses H through N may additionally or alternatively be implemented by a method, a computing device, or via a computer-readable storage medium.

[0216] Example Clause O. A computing device comprising:

[0217] one or more data processing units; and

[0218] A computer-readable medium having encoded thereon computer-executable instructions for causing the one or more data processing units to perform operations including:

[0219] receiving a first request to perform an operation on data associated with a user account;

[0220] authenticating the first request based on a username and password associated with the user account;

[0221] receiving a second request for an operation associated with the enhanced authentication protocol;

[0222] executing the enhanced authentication protocol to authenticate the second request;

[0223] In response to authenticating the second request, granting a temporary strong authentication state permission to perform the operation associated with the enhanced authentication protocol on the data associated with the user account; and

[0224] In response to a failure to authenticate the second request, the request to perform the operation associated with the enhanced authentication protocol is denied while allowing operations not associated with the enhanced authentication protocol to be performed.

[0225] Example Clause P, a computing device according to claim 15, further comprising: hiding visibility of the operations associated with the enhanced authentication protocol when the enhanced authentication protocol does not belong to Example Clause O, wherein the permission is based on using an access control list (ACL) to grant access to the authentication state.

[0226] Example clause Q, a computing device according to claim 15, further comprising: hiding visibility of the operations associated with the enhanced authentication protocol when the enhanced authentication protocol does not belong to example clause O or P, wherein the ACL automatically expires after a predetermined time.

[0227] Example Clause R, a computing device according to claim 15, further comprising: when the enhanced authentication protocol does not belong to Example Clause O to Example Clause Q, hiding visibility of the operations associated with the enhanced authentication protocol, wherein the permission is not granted to the security subject.

[0228] Example Clause S, a computing device according to claim 15, further includes: hiding the visibility of the operations associated with the enhanced authentication protocol when the enhanced authentication protocol does not belong to Example Clause O to Example Clause R, and further includes: hiding the visibility of the operations associated with the enhanced authentication protocol when the enhanced authentication protocol has not yet been executed.

[0229] Example Clause T, a computing device according to claim 15, further comprising: when the enhanced authentication protocol does not belong to Example Clause O to Example Clause S, hiding visibility of the operations associated with the enhanced authentication protocol, wherein the temporary strong authentication state is associated with an expiration time.

[0230] Although example clauses P to T are described above for the computing device of claim 15 and also include: hiding visibility of the operations associated with the enhanced authentication protocol when the enhanced authentication protocol is not yet in place, it should be understood in the context of the present disclosure that the subject matter of example clauses P to T may additionally or alternatively be implemented as a method, device, or system.

[0231] Example clause U, a method for controlling access to data stored in a cloud-based storage service, the method comprising:

[0232] receiving, at the cloud-based storage service, a first request to access data stored at the cloud-based storage service, the data being associated with a user account;

[0233] authenticating the first request based on a username and password associated with the user account;

[0234] receiving, at the cloud-based storage service, a second request for a file stored in a region associated with an enhanced authentication protocol;

[0235] executing the enhanced authentication protocol to authenticate the second request;

[0236] In response to authenticating the second request, granting a temporary strong authentication state permission to access the file stored in the area associated with the enhanced authentication protocol; and

[0237] In response to a failure to authenticate the second request, access to the file stored in the zone associated with the enhanced authentication protocol is denied while allowing access to files stored in other zones associated with the user account.

[0238] Example clause V, a method according to example clause U, wherein the permission is based on using an access control list (ACL) to grant access to the authentication state.

[0239] Example clause W, a method according to example clause U or example clause V, wherein the ACL automatically expires after a predetermined time.

[0240] Example Clause X. A method for controlling access to data stored in a cloud-based storage service, the method comprising:

[0241] receiving, at the cloud-based storage service, a first request to access data stored at the cloud-based storage service, the data being associated with a user account;

[0242] authenticating the first request based on a username and password associated with the user account;

[0243] receiving, at the cloud-based storage service, a second request for a file stored in a region associated with an enhanced authentication protocol;

[0244] executing the enhanced authentication protocol to authenticate the second request;

[0245] In response to authenticating the second request, granting a temporary strong authentication state permission to access the file stored in the area associated with the enhanced authentication protocol; and

[0246] In response to a failure to authenticate the second request, access to the file stored in the zone associated with the enhanced authentication protocol is denied while allowing access to files stored in other zones associated with the user account.

[0247] Although example clauses U to X are described above with respect to a method, it should be understood in the context of the present disclosure that the subject matter of example clauses U to X may additionally or alternatively be implemented as a system, a computing device, or via a computer-readable storage medium.

[0248] Example clause Y. A method for controlling access to data stored in a cloud-based storage service, the method comprising:

[0249] storing data associated with the user account at the cloud-based storage service;

[0250] associating a portion of the data with an enhanced authentication protocol;

[0251] receiving, at the cloud-based storage service, a first request for an application to access data associated with the enhanced authentication protocol;

[0252] authenticating the first request based on the enhanced authentication protocol;

[0253] In response to authenticating the first request, granting the application permission to access search data associated with the enhanced authentication protocol, wherein the permission is time-limited;

[0254] determining that the application is editing the data associated with the enhanced authentication protocol; and

[0255] While the application is editing the data, the permission for the application to access the data is temporarily extended.

[0256] Example clause Z, a method according to example clause Y, wherein extending the permission includes: generating a sub-token associated with a secondary policy derived from an original token associated with the first request.

[0257] Example clause AA, a method according to example clause Y or example clause Z, wherein the sub-token policy is decoupled from the original token.

[0258] Example clause BB, a method as described in any of example clauses Y to AA, wherein the sub-token policy is derived from the original token.

[0259] Example clause CC, a method according to any one of example clauses Y to BB, wherein the life cycle of the sub-token policy is separated from the original token.

[0260] Example clause DD, a method according to any one of example clauses Y to CC, wherein the lifecycle of the sub-token policy is bound to the original token.

[0261] Although example clauses Y through DD are described above with respect to a method, it should be understood in the context of the present disclosure that the subject matter of example clauses Y through DD may additionally or alternatively be implemented as a system, a computing device, or via a computer-readable storage medium.

[0262] Example Clause EE, A method for controlling access to data stored in a cloud-based storage service, the method comprising:

[0263] storing data associated with the user account at the cloud-based storage service;

[0264] receiving, at the cloud-based storage service, a first request to associate a portion of the data with an enhanced authentication protocol;

[0265] In response to the first request, requiring the enhanced authentication protocol to access the portion of the data;

[0266] receiving, at the cloud-based storage service, a second request for a file stored in the region associated with the enhanced authentication protocol;

[0267] authenticating the second request based on the enhanced authentication protocol;

[0268] In response to authenticating the second request, granting permission to access the file stored in the area associated with the enhanced authentication protocol; and

[0269] In response to a failure to authenticate the second request, denying access to the files stored in the area associated with the enhanced authentication protocol, while allowing access to files stored in other areas associated with the user account based on authentication according to a single-factor authentication mechanism associated with the user account.

[0270] Although example clause EE is described above with respect to a method, it should be understood in the context of the present disclosure that the subject matter of example clause EE may additionally or alternatively be implemented as a system, a computing device, or via a computer-readable storage medium.

[0271] Example Clause FF. A method for controlling access to data stored in a cloud-based storage service, the method comprising:

[0272] storing data associated with the user account at the cloud-based storage service;

[0273] associating a portion of the data with an enhanced authentication protocol;

[0274] receiving, at the cloud-based storage service, a request for an application to access data associated with an enhanced authentication protocol, the request including an indication that the application is configured to interact with the data using the enhanced authentication protocol;

[0275] Based on the indication, authenticating the request based on the enhanced authentication protocol;

[0276] In response to authenticating the first request, granting permission to the application to access the data associated with the enhanced authentication protocol, and;

[0277] In response to receiving the request that does not include an indication that the application is configured to interact with data utilizing the enhanced authentication protocol, visibility of the portion of the data utilizing the enhanced authentication protocol is hidden.

[0278] Although example clause FF is described above with respect to a method, it should be understood in the context of the present disclosure that the subject matter of example clause FF may additionally or alternatively be implemented as a system, a computing device, or via a computer-readable storage medium.

Claims

1. A method for controlling access to data stored in a cloud-based storage service, the method comprising: receiving, at the cloud-based storage service, a first request to access data stored at the cloud-based storage service, the data being associated with a user account; authenticating the first request based on a username and password associated with the user account; receiving, at the cloud-based storage service, a second request for a file stored in a region associated with an enhanced authentication protocol; executing the enhanced authentication protocol to authenticate the second request; In response to authenticating the second request, granting a temporary strong authentication state permission to access the file stored in the area associated with the enhanced authentication protocol; receiving, at the cloud-based storage service, a third request for a specified action associated with the enhanced authentication protocol; In response to authenticating the third request, granting permission to the temporary strong authentication state to perform the specified action associated with the enhanced authentication protocol, wherein the specified action is part of an action set associated with a file system of the cloud-based storage service but not associated with a specified file; as well as In response to a failure to authenticate the second request or the third request, deny access to the files stored in the area associated with the enhanced authentication protocol while allowing access to files stored in other areas associated with the user account, or deny the request to perform the specified action associated with the enhanced authentication protocol while allowing actions not associated with the enhanced authentication protocol.

2. The method according to claim 1, wherein: The permissions are based on using an access control list (ACL) to grant access rights to the temporary strong authentication state.

3. The method according to claim 2, wherein: The ACL automatically expires after a predetermined time.

4. The method according to claim 1, wherein: The permission has not been granted to the security principal.

5. The method according to claim 1, further comprising: When an enhanced authentication protocol has not been executed, visibility of the area associated with the enhanced authentication protocol is hidden.

6. The method according to claim 1, wherein: The temporary strong authentication state is associated with an expiration time.

7. The method according to claim 1, wherein: The files are accessed via the file system.

8. A system for controlling operations performed in a cloud-based storage service, the system comprising: one or more data processing units; as well as A computer-readable medium having encoded thereon computer-executable instructions for causing the one or more data processing units to perform operations including: receiving a first request to perform an action on data associated with a user account; authenticating the first request based on a username and password associated with the user account; receiving a second request for a specified action associated with the enhanced authentication protocol; executing the enhanced authentication protocol to authenticate the second request; In response to authenticating the second request, granting permission to perform the specified action associated with the enhanced authentication protocol to a temporary strong authentication state, wherein the specified action is part of an action set associated with a file system of the cloud-based storage service but not associated with a specified file; receiving a third request for a file stored in an area associated with the enhanced authentication protocol; In response to authenticating the third request, granting the temporary strong authentication state permission to access the file stored in the area associated with the enhanced authentication protocol; and In response to a failure to authenticate the second request or the third request, denying the request to perform the specified action associated with the enhanced authentication protocol while allowing actions not associated with the enhanced authentication protocol, or denying access to the files stored in the area associated with the enhanced authentication protocol while allowing access to files stored in other areas associated with the user account.

9. The system according to claim 8, wherein: The permissions are based on using an access control list (ACL) to grant access rights to the temporary strong authentication state.

10. The system according to claim 9, wherein: The ACL automatically expires after a predetermined time.

11. The system according to claim 8, wherein: The permission has not been granted to the security principal.

12. The system of claim 8, further comprising: When the enhanced authentication protocol has not been executed, visibility of the data associated with the user account is hidden.

13. The system according to claim 8, wherein: The temporary strong authentication state is associated with an expiration time.

14. The system according to claim 8, wherein: The data is accessed via the file system.

15. A computing device comprising: one or more data processing units; as well as A computer-readable medium having encoded thereon computer-executable instructions for causing the one or more data processing units to perform operations including: receiving a first request to perform an action on data associated with a user account; authenticating the first request based on a username and password associated with the user account; receiving a second request for a specified action associated with the enhanced authentication protocol; executing the enhanced authentication protocol to authenticate the second request; In response to authenticating the second request, granting permission to perform the specified action associated with the enhanced authentication protocol to a temporary strong authentication state, wherein the specified action is part of an action set associated with a file system of a cloud-based storage service but not associated with a specified file; receiving a third request for a file stored in an area associated with the enhanced authentication protocol; In response to authenticating the third request, granting the temporary strong authentication state permission to access the file stored in the area associated with the enhanced authentication protocol; and In response to a failure to authenticate the second request or the third request, denying the request to perform the specified action associated with the enhanced authentication protocol while allowing actions not associated with the enhanced authentication protocol, or denying access to the files stored in the area associated with the enhanced authentication protocol while allowing access to files stored in other areas associated with the user account.

Images